LoLLMs WEBUI - Server-Side Request Forgery

LoLLMs WEBUI contains a server-side request forgery caused by unauthenticated access to the /api/proxy endpoint, letting attackers force the server to make arbitrary GET requests, exploit requires no authentication. id: CVE-2026-33340 info: name: LoLLMs WEBUI - Server-Side Request Forgery author:...

Mailpit < 1.28.3 - Server-Side Request Forgery

Mailpit = 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests. id: CVE-2026-21859 info: name: Mailpit 1.28.3 -...

CVE-2026-33340

CVE-2026-33340: SSRF in lollms-webui Overview Field| Detail ---|--- CVE ID| CVE-2026-33340 Vulnerability| Server-Side Request Forgery SSRF Affected Product| ParisNeo/lollms-webui LoLLMs WEBUI Severity| Critical — CVSS 9.1 CVSS Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-918:...

CVE-2026-122009

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flinkweb Proxy Endpoint. This manipulation of...

EUVD-2026-117077

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flinkweb Proxy Endpoint. This manipulation of...

CVE-2026-122009

A flaw exists in DataLinkDC Dinky up to version 1.2.5 within the flink_web Proxy Endpoint component. Specifically, the function FlinkWebURITemplateProxyServlet.getNewTargetUri in the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java is vulnerable to Server-Side R...

CVE-2026-122009 DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flinkweb Proxy Endpoint. This manipulation of...

CVE-2026-122009 DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flinkweb Proxy Endpoint. This manipulation of...

PT-2026-137146

A flaw has been found in DataLinkDC Dinky up to 1.2.5. This vulnerability affects the function FlinkWebURITemplateProxyServlet.getNewTargetUri of the file dinky-admin/src/main/java/org/dinky/utils/FlinkWebURITemplateProxyServlet.java of the component flink web Proxy Endpoint. This manipulation of...

CVE-2026-88809

A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint /meta/proxy. This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being...

CVE-2026-88809

A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint /meta/proxy. This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being...

EUVD-2026-115258

A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint /meta/proxy. This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being...

CVE-2026-88809

A Server-Side Request Forgery (SSRF) vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). The flaw occurs because the allowlist decision was evaluated in a logic path that failed to prevent requests from being forwarded; while rejected destinations were logged, the ...

PT-2026-135505

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions 2.15.0 through 2.15.3 SUSE Rancher versions 2.14.0 through 2.14.7 SUSE Rancher versions 2.13.0 through 2.13.11 SUSE Rancher versions 2.12.0 through 2.12.15 SUSE Rancher versions 2.11.0 through 2.11.19 Description An issue...

CVE-2026-112237

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can...

CVE-2026-112237 Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can...

CVE-2026-112237 Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can...

CVE-2026-112237

The Kitodo.Presentation extension (dlf) is vulnerable to a Server-Side Request Forgery (SSRF) . The issue stems from a public proxy endpoint that fails to apply authorization checks for one specific HTTP request method. This allows an unauthenticated attacker to force the server to send requests ...

CVE-2026-112237

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can...

EUVD-2026-104870

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can...