The vulnerability of the handle_pdf_document() function in the framework for creating AI agents, Agent Zero, allows a perpetrator to perform an SSRF attack.

The vulnerability of the handlepdfdocument function in the framework for creating AI agents like Agent Zero is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute an SSRF attack...

The vulnerability of the final loading point of the corporate version of the GitHub Enterprise Server, which allows a violator to disclose protected information

The vulnerability of the final download point of the corporate version of the GitHub Enterprise Server is related to insufficient validation of requests on the server side. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Allocation of Resources Without Limits or Throttling

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the fetch adapter when finite size limits are configured but not enforced. An attacker can exhaust server resource...

The vulnerability of the RoundCube Webmail email client lies in the lack of validation for incoming requests, allowing attackers to delete any files they desire.

The vulnerability of the RoundCube Webmail email client is related to the lack of validation for incoming requests. Exploiting this vulnerability could allow a malicious actor to delete any files at will...

IBM OPENBMC Denial-of-Service Vulnerability

IBM OpenBMC is an open-based board management controller firmware, primarily used for server hardware monitoring and management. IBM OpenBMC has a denial-of-service vulnerability. The vulnerability arises from the failure to properly validate requests from unauthenticated network users. Attackers...

Typebot 安全漏洞

Typebot is an open-source chat bot builder developed by Baptiste Arnaud. Versions of Typebot 3.15.2 and earlier contained a security vulnerability. This vulnerability stemmed from the fact that HTTP request blocks and code blocks validated the initial request URL using validateHttpReqUrl. However...

The vulnerability of the IKEv2 VPN server implementation in the operating system PAN-OS allows a perpetrator to cause a service failure.

The vulnerability of the IKEv2 VPN server implementation in the PAN-OS operating system is related to insufficient validation of requests on the server side. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the Next.js software platform for creating web applications stems from insufficient validation of requests on the server side. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Next.js web application development software platform is related to insufficient validation of requests at the server side. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Nginx UI server’s user interface allows a perpetrator to execute arbitrary code.

The vulnerability of the Nginx UI server’s user interface is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20260507-73-0005

Vulnerability in roundcubemail related to lack of validation of received requests. Exploitation of the vulnerability could allow a remote attacker to disclose protected information...

The vulnerability of the “removable blocking” function in the RoundCube Webmail email client allows attackers to disclose protected information and circumvent existing security restrictions.

The vulnerability of the “deleted image blocking” function in the RoundCube Webmail client lies in the lack of validation during incoming requests. Exploiting this vulnerability allows an attacker to disclose protected information and circumvent existing security restrictions...

CVE-2026-34981 whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3

The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.downloadfromurl in app/services/fileservice.py calls requests.geturl with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by...

The vulnerability of the Azure Cloud Shell, a browser-based interactive environment, arises from insufficient validation of requests on the server side. This allows attackers to escalate their privileges.

The vulnerability of the Azure Cloud Shell, a browser-based interactive environment, is related to insufficient validation of requests on the server side. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

The vulnerability of Microsoft Purview’s data management tool, related to insufficient validation of server-side requests, allows attackers to escalate their privileges.

The vulnerability of the Microsoft Purview data management tool is related to insufficient testing of requests on the server side. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

Improper Validation of Syntactic Correctness of Input

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

CVE-2026-32857

Firecrawl version 2.8.0 and prior contain a server-side request forgery SSRF protection bypass vulnerability in the Playwright scraping service where network policy validation is applied only to the initial user-supplied URL and not to subsequent redirect destinations. Attackers can supply an...

CVE-2017-20221

Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains a cross-site request forgery vulnerability that allows authenticated attackers to execute arbitrary system commands by exploiting missing request validation. Attackers can craft malicious web pages that perform administrative actions when...

ROS-20260319-73-0032

Vulnerability in glpi related to insufficient validation of incoming requests. Exploitation of the vulnerability could allow a remote attacker to launch an ssrf attack...

EUVD-2026-12749

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to version 1.4.27, an Elysia cookie can be overridden by prototype pollution , eg. proto. This issue is patched in 1.4.27. As a workaround, use t.Cookie validatio...

CVE-2017-20221

Telesquare SKT LTE Router SDT-CS3B1 version 1.2.0 contains a cross-site request forgery vulnerability that allows authenticated attackers to execute arbitrary system commands by exploiting missing request validation. Attackers can craft malicious web pages that perform administrative actions when...