CVE-2026-111751

A denial of service DoS vulnerability was identified in "@angular/router" when Server-Side Rendering SSR is enabled on Node.js V8 and "RouterLink" directives are rendered with "queryParamsHandling: 'merge'" or "'preserve'", configured either per link or globally via "defaultQueryParamsHandling"...

CVE-2026-111752

A denial of service DoS vulnerability was identified in "@angular/router" when Server-Side Rendering SSR is enabled on Node.js V8. During route recognition, "@angular/router" fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name...

CVE-2026-111754

An open redirect vulnerability was identified in "@angular/platform-server" when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by "ServerPlatformLocation" using "resolveUrl" or "parseUrl" in v20. While...

CVE-2026-112308

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

Agent2Agent A2A Rust SDK server request forgery vulnerability

The Agent2Agent A2A Rust SDK 0.4.3 and earlier versions have a vulnerability related to server-side request forgery. This vulnerability stems from improper handling of parameters in the HttpPushSender function of the Push Notification Handler component. The improper handling involves the paramete...

Eclipse CSI - PIA server request forgery vulnerability

Eclipse CSI – Versions 0.8.0 and earlier contain a server-side request forgery vulnerability. This vulnerability arises because the verifytoken function fails to parse the jwksuri in OIDC discovery documents as a URL, fails to compare it with the source of an approved issuer, and does not enforce...

Apostrophe Technologies ApostropheCMS: Server-side Request Forgery Vulnerability

Apostrophe Technologies' ApostropheCMS has a vulnerability related to server-side request forgeing. This vulnerability stems from the AI helper, which allows editors with image-generation capabilities to create base64-encoded image records without saving the provider’s URL. This triggers image...

TYPO3 Kitodo.Presentation: Server-side request forgeing vulnerability

Versions of TYPO3 prior to 6.0.1 and from 7.0.0 to 7.0.2 contain a server-side request forgeing vulnerability. This vulnerability stems from an HTTP request method that fails to perform authorization checks. As a result, the requester has full control over the accessed URL. Unauthenticated...

EUVD-2026-104400

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

CVE-2026-112308

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

Security Bulletin: Worksoft Connective Automation Platform for IBM is affected by a vulnerability in NuGet RestSharp

Summary NuGet RestSharp is used by Worksoft Connective Automation Platform for IBM as part of .Net6 CVE-2024-45302 Vulnerability Details CVEID:CVE-2024-45302 DESCRIPTION: RestSharp is a Simple REST and HTTP API Client for .NET. The second argument to RestRequest.AddHeader the header value is...

CVE-2026-112288

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...

CVE-2026-111936

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...

EUVD-2026-104285

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...

EUVD-2026-104315

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...

CVE-2026-112076

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

EUVD-2026-104059

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

CVE-2026-112076 alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

CVE-2026-112076

A Server-Side Request Forgery (SSRF) vulnerability exists in alexta69 MeTube up to version 2026.09.28 . The flaw originates in the Feed-metadata Thumbnail Fetch Handler component, specifically within the DownloadQueue./__write_feed_metadata_sync function located in the app/ytdl.py file. This vuln...

CVE-2026-112076

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...