28101 matches found
SUSE SLES16 Security Update : python-PyJWT (SUSE-SU-2026:22170-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22170-1 advisory. This update for python-PyJWT fixes the following issues - CVE-2026-48522: PyJWKClient passes URI arguments directly to...
SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:2626-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2626-1 advisory. This update for python-PyJWT fixes the following issues - CVE-2026-48522: PyJWKClient passes URI arguments...
PT-2026-52661
Name of the Vulnerable Software and Affected Versions Rapid7 InsightConnect Markdown Plugin versions prior to 3.1.5 Description Server-Side Cross-Site Scripting XSS and Server-Side Request Forgery SSRF exist in the markdown to pdf action. These issues occur because the PDF rendering engine fails ...
SUSE SLED15 / SLES15 Security Update : python-PyJWT (SUSE-SU-2026:2627-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2627-1 advisory. This update for python-PyJWT fixes the following issues - CVE-2026-48522: PyJWKClient passes URI arguments...
PT-2026-52849
Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.9 Description A Server-Side Request Forgery SSRF issue exists in the image import functionality. Authenticated users possessing the can create images entitlement can interact with internal network...
PT-2026-52839
Server side template inject SSTI in the expression evaluation component in Genshi Template Engine version 0.7.9 allows a remote attacker to achieve remote code execution RCE via crafted template expressions...
CVE-2026-13318 Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip
A server-side request forgery SSRF flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance VMI, virt-api reads the target IP from vmi.Status.Interfaces0.IP and passes it directly to net.Dial without validation. For VMIs using...
CVE-2026-13318
KubeVirt exposes an SSRF in virt-api port-forward: when handling a port-forward to a VirtualMachineInstance, virt-api reads vmi.Status.Interfaces[0].IP and dials it without validation. For VMIs using non-masquerade networks (bridge or secondary-only), this IP is supplied by the in-guest QEMU agen...
CVE-2026-13318
A server-side request forgery SSRF flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance VMI, virt-api reads the target IP from vmi.Status.Interfaces0.IP and passes it directly to net.Dial without validation. For VMIs using...
CVE-2026-50221
A flaw was found in OpenStack Swift's proxy-server. Internal container update routing headers X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device are not stripped from client requests before being forwarded to object-servers. An authenticated user with write access can inje...
GO-2026-5652 QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0 in github.com/QuantumNous/new-api...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the LinkCheck process due to incomplete validation of IPv6 transition mechanisms. An attacker can access internal network resources by submitting specially crafted requests that exploit the insufficie...
GO-2026-5688 Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms in github.com/axllent/mailpit
Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms in github.com/axllent/mailpit...
GO-2026-5702 SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering in github.com/siyuan-note/siyuan/kernel
SiYuan Affected by Zero-Click NTLM Hash Theft and Blind SSRF via Mermaid Diagram Rendering in github.com/siyuan-note/siyuan/kernel...
GO-2026-5594 Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno
Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF in github.com/kyverno/kyverno...
GO-2026-5621 Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access in github.com/kyverno/kyverno
Kyverno has SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access in github.com/kyverno/kyverno...
GO-2026-5535 Casdoor vulnerable to SSRF via crafted Webhook URL in github.com/casdoor/casdoor
Casdoor vulnerable to SSRF via crafted Webhook URL in github.com/casdoor/casdoor...
GO-2026-5607 MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry
MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist in github.com/modelcontextprotocol/registry...
GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd...