PT-2026-65615

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.63.0 Description A server-side request forgery SSRF exists due to a time-of-check/time-of-use TOCTOU gap during DNS resolution. The software validates the resolved IP of a fetch target to block...

PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool

SummaryThe webcrawl function in praisonaiagents/tools/webcrawltools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. This allows an attacker or prompt injection in crawled conten...

NPM: OpenClaw's browser act interactions could bypass private-network navigation checks

NPM: OpenClaw's browser act interactions could bypass private-network navigation checks vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.18...

OpenClaw 代码问题漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.5.18 had code vulnerabilities. These vulnerabilities stemmed from server-side request forgeing issues in browser control, allowing authenticated users to bypass private network...

CVE-2026-40150

PraxisonAIAgents’ web_crawl() (praisonaiagents/tools/web_crawl_tools.py) before version 1.5.128 accepts arbitrary URLs with zero validation. There is no scheme allowlisting, hostname/IP blocklisting, or private-network checks prior to fetching, enabling potential SSRF and local file read via file...

CVE-2026-32236 @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery SSRF vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metadata fetch validates the initial clientid...