10423 matches found
EUVD-2026-42512
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated media-proxying endpoint, allowing anonymous users to make the site fetch arbitrary URLs, including internal and private-network addresses, and read back...
CVE-2026-60105 Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass
Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. An unauthenticated attacker can obta...
UBUNTU-CVE-2026-58501
Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...
Improper Resource Shutdown or Release
Overview engine.io is a realtime engine behind Socket.IO. It provides the foundation of a bidirectional connection between client and server Affected versions of this package are vulnerable to Improper Resource Shutdown or Release through the polling request handler in Polling transport processin...
Allocation of Resources Without Limits or Throttling
Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper handling of the MaxAuthTries parameter during the authentication process. An attacker can exhaust server resources by repeatedly attempting authentication using GSSAPI...
The vulnerability of the SVG file analysis function in the console-based graphic editor ImageMagick allows a hacker to trigger a service failure.
The vulnerability of the SVG file analysis function in the console-based graphic editor ImageMagick is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
The vulnerability of the hclgevf_knic_setup() function in the drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c file of the Linux operating system’s Ethernet network adapter driver module allows a hacker to cause a service failure.
The vulnerability of the hclgevfknicsetup function in the drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevfmain.c file of the Linux kernel’s Ethernet network adapter driver is related to the lack of resource initialization. Exploiting this vulnerability could allow an attacker to cause a system...
The vulnerability of the net/netfilter/ipset component of the Linux operating system, which allows a hacker to cause a service failure.
The vulnerability of the net/netfilter/ipset component of the Linux operating system’s kernel is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow an attacker to cause a service failure...
The vulnerability of the af_unix component in the Linux operating system kernel allows a hacker to trigger a service failure.
The vulnerability of the afunix component in the Linux operating system kernel is related to the simultaneous execution using shared resources with incorrect synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-58468
NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin...
GO-2026-5380 Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo
Hugo: Symlink confinement bypass in resources.Get in github.com/gohugoio/hugo...
PYSEC-2026-2034 WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
Summary A Server-Side Request Forgery SSRF Protection Bypass exists in WeasyPrint's defaulturlfetcher. The vulnerability allows attackers to access internal network resources such as localhost services or cloud metadata endpoints even when a developer has implemented a custom urlfetcher to block...
PYSEC-2026-1522 Langflow vulnerable to Server-Side Request Forgery
Vulnerability Overview Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block...
CVE-2026-12352
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...
FastChat Server-Side Request Forgery vulnerability
A Server-Side Request Forgery SSRF vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials...
PYSEC-2026-1408 gradio Server Side Request Forgery vulnerability
In gradio =4.42.0, the gr.DownloadButton function has a hidden server-side request forgery SSRF vulnerability. The reason is that within the saveurltocache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resourc...
CVE-2026-12352
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...
CVE-2026-12352 Incorrect Authorization
This vulnerability allows an unauthenticated actor to bypass authentication and gain access to restricted resources on the device...
