CVE-2026-58468 NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin...

CVE-2026-58468 NocoBase 2.1.20 Server-Side Request Forgery via serverRequest wrapper

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin...

CVE-2026-58468

NocoBase up to version 2.1.20 is affected by a server-side request forgery via the serverRequest wrapper. Authenticated administrators can craft arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin. Exploitation ta...

Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

SummaryThe download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints AWS/GCP/Azure, as well as...

PYSEC-2026-1581 Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Summary The download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow attackers to access internal services and attempt to reach cloud provider metadata endpoints AWS/GCP/Azure, as well as...

Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification

SummaryA Server-Side Request Forgery SSRF vulnerability in Cowrie's emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts. DetailsWhen Cowrie operates in emulated shell mod...

PYSEC-2026-1280 Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification

Summary A Server-Side Request Forgery SSRF vulnerability in Cowrie's emulated shell mode allows unauthenticated attackers to abuse the honeypot as an amplification vector for HTTP-based denial-of-service attacks against arbitrary third-party hosts. Details When Cowrie operates in emulated shell...

PYSEC-2026-1616 MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS

A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability 500 errors until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Thank y...

PYSEC-2026-1713 OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint

Impact OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-data request to OctoPrint and through that make the web server component become unresponsive. This could be used to effectively run ...

mezzanine (>=3.0.0, <=3.0.4) potentially affected by CVE-2024-47081 via requests (1.2.3)

requests PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - mezzanine =3.0.0, =3.0.4 Source cves: CVE-2024-47081 Source advisory: OSV:PYSEC-2026-1872...

callllm (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-47081 via requests (0.13.7)

requests PYPI version 0.13.7 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - callllm =0.1.0, =0.1.1 Source cves: CVE-2024-47081 Source advisory: OSV:PYSEC-2026-1872...

128autograder (>=5.0.1, <=6.0.0rc4), 128autograder-python (6.0.0rc1) +12392 more potentially affected by CVE-2024-47081 via requests (>=2.0.0, <=2.32.3)

requests PYPI version =2.0.0, =5.0.1, =0.0.1a0, =0.1.1001, =0.1.0, =0.0.2, =0.0.5, =0.1.0, =0.1.0, =0.1.8 - a3m 0.1.0 and more Source cves: CVE-2024-47081 Source advisory: OSV:PYSEC-2026-1872...

hoard (1.1.1), maxipago-sdk (>=1.0.0, <=1.0.4) potentially affected by CVE-2024-47081 via requests (1.1.0)

requests PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - hoard 1.1.1 - maxipago-sdk =1.0.0, =1.0.4 Source cves: CVE-2024-47081 Source advisory: OSV:PYSEC-2026-1872...

tinyblog (>=0.3.0, <=0.5.2) potentially affected by CVE-2024-47081 via requests (1.2.0)

requests PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - tinyblog =0.3.0, =0.5.2 Source cves: CVE-2024-47081 Source advisory: OSV:PYSEC-2026-1872...

gdshechka (2.4.0) potentially affected by CVE-2024-47081 via requests (0.14.2)

requests PYPI version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - gdshechka 2.4.0 Source cves: CVE-2024-47081 Source advisory: OSV:PYSEC-2026-1872...

Requests vulnerable to .netrc credentials leak via malicious URLs

ImpactDue to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. WorkaroundsFor older versions of Requests, use of the .netrc file can be disabled with trustenv=False on your Requests Session docs...

PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs

Impact Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Workarounds For older versions of Requests, use of the .netrc file can be disabled with trustenv=False on your Requests Session docs. References...

cklauth (>=0.1.0, <=0.3.0), django-models-logging (1.0.0) +9 more potentially affected by CVE-2026-53877 via django (2.0.0)

django PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cklauth =0.1.0, =0.1.0, =1.7.0, =1.7.2 - djangotheming 0.1.0 - fastaudiovisal 0.0.1 - fastaudiovisual 0.0.1 - ip2l 8.5.1 - prediction 0.0.3 -...

GO-2026-5889 Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled in github.com/projectcontour/contour

Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled in github.com/projectcontour/contour...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the core process. An attacker can access internal network resources by sending specially crafted UDP requests that bypass access control checks. Remediation Upgrade github.com/apernet/hysteria/extras/v2/outboun...