CVE-2026-45806

CVE-2026-45806 Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering. Intro I found this issue while reviewin...

next_js_poisoning

CVE-2024-4698 is a cache poisoning vulnerability in Next.js that impacts versions 13.5.1 to 13.5.7, as well as 14.0.0 through 14.2.10. The issue arises when websites leverage the next/image?url= API with the ?url= parameter, enabling attackers to load images hosted on their own servers. These...

EUVD-2026-102750

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches, which allows a remote attacker to cause memory exhaustion on the server via a crafted oversized ima...

CVE-2026-110718

The TurboDocx html-to-docx library (versions through 1.23.1 ) is vulnerable to a Server-Side Request Forgery (SSRF) . An attacker providing malicious HTML can force the server to fetch internal URLs using the img src attribute. This is possible because the isValidUrl() check is too loose, allowin...

CVE-2026-110718 TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download

TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...

CVE-2026-110718 TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download

TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...

CVE-2026-109294 Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, whi...

CVE-2026-109294

Open WebUI versions 0.6.42 before 0.11.4 are vulnerable to an uncontrolled resource consumption vulnerability (CWE-400). Authenticated users can trigger a denial of service for all users by providing compressed remote image URLs in chat messages. The flaw exists in the get_image_base64_from_url f...

CVE-2026-109294 Open WebUI 0.6.42 before 0.11.4 Memory Exhaustion via Compressed Remote Image

Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by supplying compressed remote image URLs in chat messages. Attackers can point the image field at a host returning gzip-encoded responses, whi...

PT-2026-105478

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

CVE-2026-86334 CLI Path Traversal via Content-Disposition in LXD Image Export/Copy

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a...

CVE-2026-86334 CLI Path Traversal via Content-Disposition in LXD Image Export/Copy

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

CVE-2026-63206 Zammad: Remote image tracking bypass via shortened URL scheme

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and email views, can be bypassed using a shortened URL format that omits the double slash after the scheme for example a shortened HTTP URL...

PT-2026-99081

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.1.2 Description The HTML sanitizer used in ticket articles and email views fails to correctly identify and block remote images when a shortened URL format is used that omits the double slash after the scheme. Because...

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380 WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

EUVD-2026-80792

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source causes server-side request forgery. The attack can be initiated...

CVE-2026-92380

WuzhiCMS up to 4.1.0 is affected by a server-side request forgery (SSRF) vulnerability in the Remote Image Fetch component. The flaw resides in the function ckditor::saveRemote within coreframe/app/attachment/index.php , where manipulation of the source[] argument allows an unauthenticated, remot...