61922 matches found
CVE-2026-69851
Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...
CVE-2026-69543
An SSRF vulnerability in Azure Virtual Machines allows an authorized low-privilege attacker to elevate privileges over a network, with a HIGH CVSS 3.1 base score of 8.5. No patch version, workaround, or exploitation evidence is provided in the documents.
CVE-2026-54508
TREK , a collaborative travel planner, is affected by a blind SSRF vulnerability prior to version 3.1.0. The root cause is that importGoogleList(), importNaverList() in placeService.ts and resolveGoogleMapsUrl() in mapsService.ts validate only the initial URL via checkSsrf() but then use fetch() ...
GHSA-8R62-W5WH-FC5M Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
Summary The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the upgrader itself accep...
Server-side Request Forgery (SSRF)
Overview @platejs/docx-io is a DOCX import/export for Plate - file-based document conversion Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the buildImage and buildParagraph functions in render-document-file.ts and xml-builder.ts, which unconditionally...
CVE-2026-63654
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulkworkflowapproval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An...
CVE-2026-66001 Frappe: Improper Authorization in OAuth2 Consent Endpoint
Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrftoken in...
CVE-2026-65842
Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the...
CVE-2026-71428 unstructured: Server-Side Request Forgery in the URL-based partitioning
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...
CVE-2026-71428
CVE-2026-71428 is a Server-Side Request Forgery (SSRF) in the unstructured Python library (versions 0.4.7 through 0.24.0 ). The url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.p...
CVE-2026-71428 unstructured: Server-Side Request Forgery in the URL-based partitioning
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...
CVE-2026-65842
Plate (a rich-text editor with AI and shadcn/ui) is affected by a server-side request forgery (SSRF) with response disclosure in the @platejs/docx-io package prior to version 53.3.2 . The htmlToDocxBlob function fetches remote image URLs from attacker-controlled HTML when used in a server-side or...
CVE-2026-64968
ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...
Azure Virtual Machines Elevation of Privilege Vulnerability
Server-side request forgery ssrf in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network...
EUVD-2026-63369
ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...
CVE-2026-64968 Server-Side Request Forgery in ATutor
ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...
EUVD-2026-63362
ATutor is vulnerable to Cross-Site Request Forgery CSRF in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is...
CVE-2026-64962 Cross-Site Request Forgery (CSRF) in ATutor
ATutor is vulnerable to Cross-Site Request Forgery CSRF in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is...
CVE-2026-64962 Cross-Site Request Forgery (CSRF) in ATutor
ATutor is vulnerable to Cross-Site Request Forgery CSRF in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is...