32257 matches found
CVE-2026-52371
A Server-Side Request Forgery (SSRF) vulnerability exists in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 . This flaw allows authenticated attackers to scan internal resources by providing a crafted HTTP request , forcing the server to make requests to unintended locations. No in...
CVE-2026-52371
A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...
PT-2026-66666
Name of the Vulnerable Software and Affected Versions Google mcp-toolbox versions 0.3.0 through 1.4.0 Description A Server-Side Request Forgery SSRF issue exists in the generic HTTP source and tool components. The HTTP client in internal/sources/http/http.go does not safely regulate request...
CVE-2026-52371
A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...
PT-2026-66769
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report client logo...
CVE-2026-52371
A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...
Security Bulletin: Multiple vulnerabilities have been addressed in IBM Aspera Shares
Summary Multiple vulnerabilities have been addressed in IBM Aspera Shares Version 1.11.4 Vulnerability Details CVEID:CVE-2026-57234 DESCRIPTION: Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the import process. An attacker can access internal resources or read arbitrary files from the server filesystem by submitting crafted filenames containing URL wrappers or path traversal sequences...
CVE-2026-67530 WACRM: SSRF via the automation `send_webhook` action
WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation sendwebhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the...
CVE-2026-66415
Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...
CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
CVE-2026-15974 CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
EUVD-2026-51263
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
CVE-2026-15974 CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
CVE-2026-15974 CVE-2026-15974
SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized imageurl, allowing access to internal metadata, secrets, and services...
CVE-2026-54722
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
SUSE CVE-2026-33655
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering to hostnames; with ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/blo...
SUSE CVE-2026-34476
Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue...
SUSE CVE-2026-35036
Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, Ech0 implements link preview editor fetches a page title through GET /api/website/title. That is legitimate product behavior, but the implementation is unsafe: the route is unauthenticated, accepts ...