CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101005

A server-side request forgery (SSRF) vulnerability exists in October CMS versions up to 4.3.4 . The flaw is located in the validateExternalImageHost function within the System/Classes/ResizeImages.php file of the SSRF Protection component. An unauthenticated remote attacker can exploit this vulne...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-100909

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

CVE-2026-44578

🚨 CVE-2026-44578 — Next.js SSRF Vulnerability 📌 Overview CVE-2026-44578 is a high-severity Server-Side Request Forgery SSRF vulnerability affecting self-hosted Next.js applications. Attackers can exploit crafted WebSocket Upgrade Requests to force the server into making outbound requests to...

CVE-2026-100909 OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

CVE-2026-100909

A server-side request forgery (SSRF) vulnerability exists in OctoberCMS versions up to 4.1.19/4.2.25/4.3.4 . The flaw is located in the getSourcePathForResize function within the modules/system/classes/ResizeImages.php file, where the manipulation of the realSourcePath argument allows for remote ...

CVE-2026-100909 OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

EUVD-2026-88081

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

CVE-2026-100909 OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed...

CVE-2026-100901

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-100900

A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function updateJiraProjects of the file /jira-import of the component Jira Import. The manipulation of the argument host/username/token leads to server-side request forgery. It i...

EUVD-2026-88068

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-100901

A Server-Side Request Forgery (SSRF) vulnerability exists in athlon1600 youtube-downloader versions up to 4.0.1 . The flaw is located in the stream function of the public/stream.php file, where the url argument can be manipulated to trigger unauthorized requests. While a specific commit (6ffe823)...

CVE-2026-100901 athlon1600 youtube-downloader stream.php stream server-side request forgery

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-100901 athlon1600 youtube-downloader stream.php stream server-side request forgery

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-100900 DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery

A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function updateJiraProjects of the file /jira-import of the component Jira Import. The manipulation of the argument host/username/token leads to server-side request forgery. It i...

EUVD-2026-88067

A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function updateJiraProjects of the file /jira-import of the component Jira Import. The manipulation of the argument host/username/token leads to server-side request forgery. It i...

CVE-2026-100900

The DevaslanPHP project-management software (versions 1.2.1/1.2.2/1.2.3/1.2.4 and v2.0.0-beta1) is vulnerable to a server-side request forgery (SSRF) . The flaw exists in the updateJiraProjects function within the Jira Import component (file: /jira-import). An attacker can manipulate the host , u...