CVE-2026-61572

AVideo, a video-sharing platform, is vulnerable to unauthenticated full-response Server-Side Request Forgery (SSRF) . The root cause lies in objects/functions.php, where url_get_contents accepts caller-controlled destinations following only basic syntax validation, failing to block private, loopb...

CVE-2026-55421

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-55421

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-55421

Open edX Platform is vulnerable to SSRF with response exfiltration in the Studio Video Download Endpoint. Prior to commit 00b7c3c, the endpoint accepts a user-supplied files[].url and performs a server-side fetch via requests.get(url, allow_redirects=True), returning the fetched bytes inside a ZI...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

EUVD-2026-70223

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-55421 Open edX Platform: SSRF in Studio Video Download Endpoint

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-55421: Server-Side Request Forgery (SSRF)

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allowredirects=True". The fetched bytes are then returned inside a ZIP response. This...

PT-2026-84819

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files.url, performs a server-side fetch using "requests.geturl, allow redirects=True". The fetched bytes are then returned inside a ZIP response. This...

CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-76838 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname and rejects private and reserved ranges, which any public hostname passes. At dispatch,...

CVE-2026-45012

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery SSRF in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch...

CVE-2026-41569 authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin...

CVE-2026-41569 authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin...

PT-2026-34205

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier Description The isSSRFSafeURL function in objects/functions.php contains a same-domain shortcircuit that allows any URL with a hostname matching webSiteRootURL to bypass Server-Side Request Forgery SSRF...

CVE-2026-39370 WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then...

CVE-2026-39370

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then...

CVE-2026-39370 WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then...

CVE-2026-39370: Server-Side Request Forgery (SSRF)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoder.json.php still allows attacker-controlled downloadURL values with common media or archive extensions such as .mp4, .mp3, .zip, .jpg, .png, .gif, and .webm to bypass SSRF validation. The server then...