pd-agent

ProjectDiscovery Cloud Platform — Agente Qué hace • Inicio rápido • Instalación • Configuración • Escalado Qué hace pd-agent le permite escanear sus propias redes internas desde la ProjectDiscovery Cloud Platform. Instale el agente en una máquina dentro de la red que quiera escanear — una VM, un...

behave

¡Behave! Una extensión de navegador de monitoreo aún en desarrollo para páginas que se portan mal. NB : Este es el repositorio de código del proyecto, si buscas las extensiones empaquetadas: Firefox: https://addons.mozilla.org/en-US/firefox/addon/behave/ Chrome:...

CVE-2026-34160

CVE-2026-34160 — Unauthenticated SSRF in Chamilo LMS via PENS plugin pens.php Severity : High CVSS 8.6 CWE : CWE-918 Server-Side Request Forgery Affected : chamilo/chamilo-lms 2.0-RC.2 Fixed in : 2.0-RC.3 Advisory : GHSA-g2xj-4cch-j276 NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-34160 Credit ...

PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summarypraisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhookURLs by resolving the hostname and checking whether the IP is private. When DNSresolution fails socket.gaierror, the validator silently passes the URL viaexcept socket.gaierror: pass. Additionally, even when DNS...

CVE-2026-48707

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...

CVE-2026-48707 InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...

Next.js 16.4.0-canary.13 Server-Side Request Forgery

Next.js version 16.4.0-canary.13 contains a DNS rebinding TOCTOU server-side request forgery vulnerability in the Image Optimizer's fetchExternalImage functionality. https://packetstorm.news/download/230572...

PT-2026-85510

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue request...

EUVD-2026-66721

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

GHSA-RG5Q-PP8P-F7JM PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114

Summary praisonai/jobs/models.py::JobSubmitRequest.validatewebhookurl validates webhook URLs by resolving the hostname and checking whether the IP is private. When DNS resolution fails socket.gaierror, the validator silently passes the URL via except socket.gaierror: pass. Additionally, even when...

GHSA-X44H-65QV-CW74 praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

Summary praisonaiagents/tools/spidertools.py contains an SSRF protection bypass. The function hostisblocked validates URLs against a list of blocked IP literals and hostname aliases, but never performs DNS resolution. Any hostname that resolves to a private or loopback IP address — including publ...

CVE-2026-77066

The scanFeedsResolver in Omnivore's API passes user-supplied URLs directly to axios.get without validation, unlike the guarded subscribe path. An authenticated user can force internal requests, leaking feed-shaped metadata and probing internal ports. CVSS 3.1 base score is 5.0 (MEDIUM). No in-the...

PT-2026-70938

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...

PT-2026-70141

Name of the Vulnerable Software and Affected Versions Friendica versions prior to 2026.08-dev Description An authenticated user with a self-registered account can perform a server-side request forgery SSRF through the link-preview endpoint. This occurs because the endpoint fetches user-supplied...

CVE-2026-9081

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...

GHSA-WVP2-4QQP-4H3R Ghost: Private IP filtering bypass to make server-side requests to internal services

Impact When making an external request, it is possible to bypass the IP filter that ensures the request isn't going to an internal service using an IPv6 literal which maps to a private IPv4 address. Vulnerable versions This vulnerability is present in Ghost from v6.0.9 up to v6.21.0. Patches...

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

Summarydatamodel-code-generator's anti-SSRF guard validates the resolved IP of a fetch target once and then lets httpx perform its own independent DNS resolution to connect, so the validated address is never pinned. A hostname that resolves to a public IP at validation time and a private IP at...

@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

Hi Novu team, Reporting an SSRF blocklist gap in the shared validateUrlSsrf guard. A complete self-contained reproduction is inlined below — copy the four files into a directory and run docker compose up, plus a single-file probe that runs against Node directly. Locally validated against HEAD...

Malicious code in n8n-nodes-pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8222d3f90f4cff83a0840ee03f4b127946274f0215a73eadd6008404a2276e The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP socket to 10.0.0.145:4444 an...

MAL-2026-11004 Malicious code in n8n-nodes-pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8222d3f90f4cff83a0840ee03f4b127946274f0215a73eadd6008404a2276e The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP socket to 10.0.0.145:4444 an...