216 matches found
CVE-2026-58141 Dify < 1.15.0 SSRF Protection Bypass via Remote-Files Endpoints
Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configuration only defining source ACLs without...
CVE-2026-58141
Dify versions prior to 1.15.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a Squid proxy configuration that lacks destination deny rules, combined with the make_request() helper performing no independent destination IP validation. Authenticated console users can bypa...
Astra Linux – Vulnerability in emacs
In Emacs versions before 29.3, the Org mode considers the contents of remote files to be trustworthy. This affects Org Mode in versions prior to 9.6.23...
CLSA-2026-1787213200 emacs: Fix of 2 CVEs
CVE-2024-30205: org-file-contents: consider all remote files unsafe...
CLSA-2026-1787212961 emacs: Fix of 2 CVEs
CVE-2024-30205: org-file-contents: consider all remote files unsafe...
CVE-2026-105762
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...
CVE-2026-105762: Server-Side Request Forgery (SSRF)
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...
CVE-2026-105762
The open-source LLM app development platform Dify is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) in the /console/api/remote-files/upload endpoint within api/controllers/web/remote_files.py. The vulnerability exists because the application accepts attacker-controlled URLs w...
CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...
CVE-2026-105762
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...
CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...
CVE-2026-105762 Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...
EUVD-2026-92866
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remotefiles.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint ...
PT-2026-106274
Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote files.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint...
CentOS Linux 7 [TuxCare] Security Update: emacs / emacs-common / emacs-el / emacs-filesystem / emacs-nox / etc (CENTOS7:CLSA-2026:1787211247)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1787211247 advisory. - In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. CVE-2024-30205 Note that...
CVE-2026-75799
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...
CLSA-2026-1787211247 emacs: Fix of CVE-2024-30205
CVE-2024-30205: org-file-contents: consider all remote files unsafe...
Wordpress Plugin Issuu Panel Remote/Local File Inclusion Detection
The WordPress Issuu Plugin includes an arbitrary file disclosure vulnerability that allows unauthenticated attackers to disclose the content of local and remote files. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Issuu Plugin includes an arbitrary file disclosure vulnerability that...
PT-2026-53456
Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not including 3.11.3, enabling a maliciously uploaded Keras file containing a TorchModuleWrapper class to run arbitrary code on an end user’s system when loaded despite safe mode being...