CVE-2026-47390 PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, spidertools URL validation can be bypassed using alternate loopback host encodings. The tool contains a URL validation function intended to block local or unsafe...

SUSE CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

CVE-2026-15927

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

wp-ssrf-cloud-metadata

WordPress Core SSRF via Cloud Metadata Endpoint Bypass in wp...

CVE-2026-15927 Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

EUVD-2026-46150

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

EUVD-2026-46120

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...

PT-2026-62414

Name of the Vulnerable Software and Affected Versions Verba RAG application version 2.1.3 Description A server-side request forgery SSRF issue combined with a same-origin middleware bypass allows unauthenticated remote attackers to force the server to issue arbitrary HTTP requests. By providing a...

PT-2026-63275

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A blind Server-Side Request Forgery SSRF exists when the oauth2 client UPDATE AVATAR = true setting is enabled. The issue occurs because the server fetches the avatar URL provided by an...

PT-2026-62100

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

PT-2026-63240

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

@apphosting/astro-adapter (0.0.1), @ayco/cozy (>=0.2.5, <=0.3.1) +68 more potentially affected by CVE-2026-59730 via @astrojs/node (>=8.1.0, <=10.1.4)

@astrojs/node NPM version =8.1.0, =0.2.5, =1.0.2, =1.0.0, =2.0.0, =0.1.3, =2.2.1, =2.2.1, =2.2.1, =1.0.0, =2.35.0, =0.1.0, =0.7.0, =0.12.0 and more Source cves: CVE-2026-59730 Source advisory: OSV:GHSA-R557-WFFQ-WVRC...

CVE-2026-64626

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...

CVE-2026-64626

The CVE affects AVideo encoder download-by-URL flow from commit 0dbadbca to latest master, where an unpinned retry fallback bypasses DNS pinning validation, enabling an authenticated attacker to supply a downloadURL that redirects to an internal address and have the unpinned retry follow the redi...

CVE-2026-64626 AVideo Encoder downloadURL SSRF via unpinned retry fallback

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...

EUVD-2026-44672

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import...

GHSA-X756-G4X3-C64M Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Summary Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets. When the remote download permission is granted to a non-admin user group, a normal...

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Summary Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets. When the remote download permission is granted to a non-admin user group, a normal...

CVE-2026-63769

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetchurl method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures, a...

USN-8572-1 wget vulnerability

It was discovered that Wget did not properly validate the IP address provided in an FTP PASV response when operating in FTP passive mode. A remote attacker controlling a malicious FTP server, or an HTTP server that redirects to an FTP URL, could possibly use this issue to redirect Wget's data...