12968 matches found
CVE-2026-73212
A flaw was found in Coturn. An authenticated client using the RFC 6062 TCP CONNECT relay path can bypass intended IPv4 denied-peer-ip range restrictions due to improper canonicalization of IPv4-compatible, 6to4, and NAT64 address forms. This vulnerability can lead to Server-Side Request Forgery...
Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to axios (CVE-2025-62718, CVE-2026-40175)
Summary Axios is vulnerable to infrastructure tampering and Critical SSRF and exposure of private internal/loopback endpoints attacks. These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser an...
CVE-2026-13176
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...
EUVD-2026-63907
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...
CVE-2026-13176 Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...
CVE-2026-13176
The Eventin WordPress plugin before 4.1.21 contains a blind Server-Side Request Forgery (SSRF) vulnerability. The plugin fails to validate user-supplied webhook URLs stored on events and does not verify event ownership, allowing authenticated users with contributor-level access or above to trigge...
CVE-2026-77775
Headroom LLM proxy (headroomlabs-ai/headroom) is vulnerable to SSRF via the x-headroom-base-url request header. The functions _resolve_openai_upstream_base and _select_passthrough_base_url accept any URL with an http/https scheme and hostname without rejecting loopback, link-local, or RFC 1918 de...
CVE-2026-77775 Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation
Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use ...
EUVD-2026-63904
Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use ...
CVE-2026-77775 Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation
Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. resolveopenaiupstreambase in headroom/proxy/handlers/openai.py accepts the header value, requires only that it parse with an http or https scheme and a hostname, and returns it for use ...
CVE-2026-61422
Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...
CVE-2026-50112
SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...
CVE-2026-50112 Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates
SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...
CVE-2026-50112
Apache CloudStack versions 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected by two related vulnerabilities in template download handling. When a tenant registers a VM template with directDownload=true pointing to a .metalink file, the management server fetches the metalink XML...
EUVD-2026-63847
SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal...
CVE-2026-59085
A Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module allows exploitation via webhook delivery requests, requiring no authentication and no user interaction. Affected versions are 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 . The CVSS v3.1 score is 9...
EUVD-2026-63845
Server-Side Request Forgery SSRF vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1....
CVE-2026-61422
Apache CloudStack (versions 4.20.3.0 and 4.21.0.0 through 4.22.1.0) is affected by an authenticated pre-validation SSRF in its template and ISO registration functionality. When a user registers a template or ISO, CloudStack issues a live HTTP HEAD/GET request to determine file size for secondary ...
EUVD-2026-63836
Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...
CVE-2026-61422 Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate
Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to determine file size for secondary storage usage-limit checks, and this happens before URL validatio...