12867 matches found
The vulnerability of the SVG file analysis function in the console-based graphic editor ImageMagick allows a hacker to trigger a service failure.
The vulnerability of the SVG file analysis function in the console-based graphic editor ImageMagick is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
The vulnerability of the net/netfilter/ipset component of the Linux operating system, which allows a hacker to cause a service failure.
The vulnerability of the net/netfilter/ipset component of the Linux operating system’s kernel is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20260708-73-0028
The vulnerability of the Grafana monitoring and observation platform’s plugin is related to the unlimited distribution of resources when processing requests to the endpoint. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...
The vulnerability of the af_unix component in the Linux operating system kernel allows a hacker to trigger a service failure.
The vulnerability of the afunix component in the Linux operating system kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause service failures...
Server-side Request Forgery (SSRF)
Overview weblate is an A web-based continuous localization system with tight version control integration Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the URL validation. An attacker can access internal network resources by submitting specially crafted UR...
CVE-2026-57172 DataEase: Hardcoded JWT Signing Secret in ShareLink
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-pwd-fit2cloud to forge linkToken JWTs,...
EUVD-2026-42093
DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-pwd-fit2cloud to forge linkToken JWTs,...
CVE-2026-58468
NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin...
GO-2026-5380 Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo
Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo...
PYSEC-2026-2034 WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
Summary A Server-Side Request Forgery SSRF Protection Bypass exists in WeasyPrint's defaulturlfetcher. The vulnerability allows attackers to access internal network resources such as localhost services or cloud metadata endpoints even when a developer has implemented a custom urlfetcher to block...
WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
SummaryA Server-Side Request Forgery SSRF Protection Bypass exists in WeasyPrint's defaulturlfetcher. The vulnerability allows attackers to access internal network resources such as localhost services or cloud metadata endpoints even when a developer has implemented a custom urlfetcher to block...
Langflow vulnerable to Server-Side Request Forgery
Vulnerability OverviewLangflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block...
PYSEC-2026-1522 Langflow vulnerable to Server-Side Request Forgery
Vulnerability Overview Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block...
CVE-2026-12352
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...
FastChat Server-Side Request Forgery vulnerability
A Server-Side Request Forgery SSRF vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials...
PYSEC-2026-1408 gradio Server Side Request Forgery vulnerability
In gradio =4.42.0, the gr.DownloadButton function has a hidden server-side request forgery SSRF vulnerability. The reason is that within the saveurltocache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resourc...
CVE-2026-12352
Technical details (affected products/versions, root cause, exploit conditions, or remediation) are not publicly provided in the supplied documents. Monitor for updates on CVE-2026-12352.
CVE-2026-12352 Incorrect Authorization
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...