Lucene search
+L

739 matches found

EUVD
EUVD
added yesterday8 views

EUVD-2026-49407

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

8.4CVSS6.1AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday5 views

CVE-2026-65558

Unauthenticated Server Side Request Forgery SSRF in AffiliateX = 2.3.5 versions...

5.4CVSS5.8AI score
SaveExploits0References2
Nuclei
Nuclei
added yesterday14 views

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

7.5CVSS7.1AI score0.6468EPSS
SaveExploits2References2
Arista
Arista
added yesterday8 views

Security Advisory 0145

Security Advisory 0145 PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release Description: SQL injection in a flow metrics API method enabling server-side request forgery CVE: CVE-2026 -17191 CVSSv3.1 Base Score: 9.1...

9.1CVSS5.8AI score
SaveExploits0
NVD
NVD
added 2 days ago10 views

CVE-2026-17458

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

6.5CVSS0.00228EPSS
SaveExploits0References6
EUVD
EUVD
added 2 days ago12 views

EUVD-2026-49053

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

6.5CVSS5.5AI score0.00228EPSS
SaveExploits0References6
CVE
CVE
added 5 days ago20 views

CVE-2026-21653

Johnson Controls CCure 9000 and Victor Application Server are affected by a SSRF vulnerability (CVE-2026-21653) impacting versions 2.9 through 3.0. The issue enables Server-Side Request Forgery due to an insecure handling of external requests within the Victor application server. CVSS 4.0 base sc...

7.2CVSS5.3AI score0.00229EPSS
SaveExploits0References1
OSV
OSV
added 5 days ago2 views

SUSE-SU-2026:3205-1 Security update for wget

This update for wget fixes the following issues - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58470: server-controlled Content-Range header values can cause an integer overflow in parsecontentrange bsc1271034. -...

7.1CVSS6.1AI score0.00247EPSS
SaveExploits0References7
CVE
CVE
added 5 days ago13 views

CVE-2026-65496

CVE-2026-65496 affects the WordPress Complianz plugin (versions ≤ 7.5.0). The description indicates an Author SSRF in Complianz ≤ 7.5.0. CVSSv3.1 base score 4.4 (Network attack, High complexity, Privileges Required: High, No user interaction; Confidentiality and Integrity Low, Availability None; ...

4.4CVSS5.3AI score0.00161EPSS
SaveExploits0References1
EUVD
EUVD
added 5 days ago4 views

EUVD-2026-48079

Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...

4.9CVSS5.3AI score0.00145EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/07/20 10:52 p.m.5 views

CVE-2026-53727

A flaw was found in cssparser from 2.2.0 before 3.0.0. CssParser::Parserreadremotefile used by loaduri! and @import handling in addblock! issues HTTP/HTTPS requests without host, IP, or scheme restrictions, including to loopback and RFC1918 targets, and recursively follows Location redirects. Tho...

8.9CVSS5.4AI score0.00302EPSS
SaveExploits0References7
NVD
NVD
added 2026/07/20 7:17 p.m.10 views

CVE-2026-63107

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use...

7.7CVSS0.00209EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/20 6:10 p.m.9 views

EUVD-2026-46055

The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses...

5.1CVSS5.2AI score0.00229EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/19 7:15 a.m.12 views

EUVD-2026-45433

A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret...

6.5CVSS6.2AI score0.00214EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/07/19 12:30 a.m.11 views

EUVD-2026-45404

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/webfetch/webfetch.py. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has...

6.5CVSS5.9AI score0.0033EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/07/18 1:10 p.m.44 views

CVE-2025-71398 SurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to denied network targets, enabling server-side request forgery to acce...

5.8CVSS0.00228EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/18 12:0 a.m.11 views

PT-2026-60975

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver thread of the file claw/services/swarm/swarm.c of the component http request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The...

7.5CVSS5.1AI score0.00288EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/07/17 8:30 p.m.11 views

EUVD-2026-45324

cssparser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parserreadremotefile in lib/cssparser/parser.rb, and therefore loaduri! and the @import-following branch of addblock!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering...

8.9CVSS5.5AI score0.00302EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/17 8:17 p.m.7 views

CVE-2026-7754

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery SSRF due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism...

7.7CVSS0.00201EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/17 8:15 p.m.11 views

EUVD-2026-45315

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function updateplugin/updateallplugins of the file astrbot/dashboard/routes/plugin.py of the component Plugin Update Handler. The manipulation of the argument downloadurl/downloadurls/proxy results in server-side...

6.5CVSS6.1AI score0.00201EPSS
SaveExploits0References5
Rows per page
Query Builder