31351 matches found
KubePlus 安全漏洞
KubePlus is a Kubernetes multi-tenant application management platform developed by cloud-ark. KubePlus 4.1.4 contains security vulnerabilities, which stem from server-side request forgery and command injection during the processing of the chartURL field by the mutating webhook and...
PT-2026-29129
Name of the Vulnerable Software and Affected Versions Kyverno versions 1.16.0 and later Description Kyverno is susceptible to Server-Side Request Forgery SSRF because of unrestricted Common Expression Language CEL HTTP functions. Recommendations Update to a newer version that contains a fix for...
Kyverno 安全漏洞
Kyverno is an open-source strategy engine designed for Kubernetes by Kyverno developers. Versions of Kyverno starting from 1.16.0 contain security vulnerabilities, which stem from the unrestricted CEL HTTP function. These vulnerabilities may lead to server-side request forgeing attacks...
SourceCodester RSS Feed Parser 代码问题漏洞
The SourceCodester RSS Feed Parser is an open-source rss feed parser developed by SourceCodester. Version 1.0 of the SourceCodester RSS Feed Parser has code vulnerabilities; these vulnerabilities stem from incorrect operations with the filegetcontents function, which may lead to server-side reque...
CVE-2026-29925
The Invoice Ninja application (specifically versions v5.12.46 and v5.12.48 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists within the CheckDatabaseRequest.php process, where an attacker can supply crafted input to make unauthorized requests to internal or external system...
CVE-2026-29925
Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery SSRF in CheckDatabaseRequest.php...
CVE-2026-29925
Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery SSRF in CheckDatabaseRequest.php...
CVE-2026-29954
In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...
PT-2026-29117
Name of the Vulnerable Software and Affected Versions CI4MS versions prior to 0.31.0.0 Description CI4MS, a CodeIgniter 4-based CMS skeleton, does not properly sanitize user-controlled input within System Settings – Mail Settings. Configuration fields, including Mail Server, Mail Port, Email...
Invoice Ninja 安全漏洞
Invoice Ninja is an open-source application developed by Invoice Ninja, featuring features for invoice management, quotation processing, project tracking, and time tracking. Versions 5.12.46 and 5.12.48 of Invoice Ninja contain security vulnerabilities, which stem from server-side request forgery...
PT-2026-29130
Name of the Vulnerable Software and Affected Versions Contact Form by Supsystic plugin for WordPress versions up to and including 1.7.36 Description The Contact Form by Supsystic plugin for WordPress is susceptible to Server-Side Template Injection SSTI, which can lead to Remote Code Execution RC...
PT-2026-29050
Name of the Vulnerable Software and Affected Versions CrewAI affected versions not specified Description CrewAI contains a server-side request forgery condition that allows for the acquisition of content from internal and cloud services. This is facilitated by Retrieval-Augmented Generation RAG...
CVE-2026-29954
In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...
PT-2026-29059
In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More critically, when kubeconfiggenerator uses wget to...
PT-2026-29163
Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.9.4 Description The /loadIG API endpoint in the FHIR Validator HTTP service does not properly validate user-supplied URLs provided via a JSON body before making server-side HTTP requests. This allows an...
Supsystic Contact Form Wordpress Plugin SSTI RCE
This module performs SSTI achieving RCE in webpages containing the Contact Form Wordpress plugin by Supsystic in versions 1.7.36 and before. Module Options msf use exploit/multi/http/wp/pluginsupsysticcontactformrce msf undefinedpluginsupsysticcontactformrce show actions ...actions... msf...
Kyverno is vulnerable to server-side request forgery (SSRF)
Overview Kyverno, versions 1.16.0 to present, contains an SSRF vulnerability in its CEL-based HTTP functions, which lack URL validation or namespace scoping and allow namespaced policies to trigger arbitrary internal HTTP requests. An attacker with only namespace-level permissions can exploit thi...
CVE-2026-29954
In KubePlus 4.1.4 , the mutating webhook and kubeconfiggenerator components are vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of the chartURL field in ResourceComposition resources. Furthermore, because the kubeconfiggenerator directly concatenates this field int...
