62036 matches found
GHSA-34PJ-2622-JVXQ @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
Summary When prettyUrls: true is enabled on @apostrophecms/file a documented SEO feature for serving uploaded files at clean URLs, the public pretty-URL handler builds the upstream URL using the raw Host HTTP request header: js proxyUrl = $req.protocol://$req.get'host'$uglyUrl That URL is then...
Security Bulletin:IBM Storage Protect Operations Center is affected by a vulnerability in IBM WebSphere Application Server Liberty that could allow remote attacker to send unauthorized requests from the system (CVE-2026-1561, CWE-918)
Summary IBM Spectrum Protect Operations Center uses IBM WebSphere Application Server Liberty in certain components; a vulnerability in Liberty may allow remote attacker to send unauthorized requests from the system, that could impact the security of the affected environment under specific...
CVE-2026-57232
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...
CVE-2026-57232
Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...
Security Bulletin: IBM Storage Protect for Space Management is vulnerable to cross-site request forgery token leakage due to Angular (CVE-2025-66035)
Summary IBM Storage Protect for Space Management uses Angular to provide web-based user interface components. A vulnerability in Angular's HttpClient could allow the leakage of Cross-Site Request Forgery XSRF tokens when protocol-relative URLs are used, potentially exposing the token to an...
CVE-2026-54729 dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
Summary isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side request forgery. POC Example to simulate 1.1.1.1 in version before 1.5.0 of dssrf: js import isurlsafe from...
GHSA-QVV7-CG9C-W4X3 Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
Summary nltk.pathsec provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges including obfuscated forms and recommending strict ENFORCE mode for security-sensitive environments. The filter is bypassable by DNS rebinding:...
EUVD-2026-51545
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...
CVE-2026-59231 Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...
CVE-2026-59231
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...
Server-Side Request Forgery (SSRF)
datamodel-code-generator is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to http.getbody in src/datamodelcodegenerator/http.py accepting --url targets and redirect chain targets without proper host/IP validation, which allows an attacker to perform server-side request...
CVE-2026-14540 Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox
A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...
CVE-2026-14540
A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...
CVE-2026-14540 Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox
A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...
SUSE CVE-2026-17534
Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...
PT-2026-66866
Name of the Vulnerable Software and Affected Versions xxl-job version 3.4.0 Description A Server-Side Request Forgery SSRF exists in the 'xxl-job-admin/jobinfo/trigger' endpoint. This issue allows authenticated attackers to scan internal resources by sending a specially crafted HTTP request. SSRF...
CVE-2026-52371
A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...
CVE-2026-50986: Cross-Site Request Forgery (CSRF)
PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...