PT-2026-68112

Name of the Vulnerable Software and Affected Versions Pixelfed affected versions not specified Description An authenticated Server-Side Request Forgery SSRF exists in the SearchController when processing the remote-search parameter. The ActivityPubFetchService uses a validateUrl function that onl...

CVE-2026-71246: Server-Side Request Forgery (SSRF)

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...

VulnCheck KEV: CVE-2020-26948

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter...

CVE-2020-26948

Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter...

PT-2020-16565 · Emby · Emby Server

Name of the Vulnerable Software and Affected Versions: Emby Server versions prior to 4.5.0 Description: The issue allows for Server-Side Request Forgery SSRF via the ImageURL parameter in the Items/RemoteSearch/Image endpoint. This means an attacker could potentially force the server to make...

DEBIAN-CVE-2014-3562

Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory...