Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Impact A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the prepareDestination rewrite/redirect handling in packages/next/src/shared/lib/router/utils/prepare-destination.ts. An attacker can make the application proxy a request t...

GHSA-6GPP-XCG3-4W24 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Impact Crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. Workarounds If you cannot upgrade immediately, enforce authorization in the page's server-side data path instead...

GHSA-2X35-3FW4-9JR4 n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

Impact The n8n Send Email node did not enforce that its message fields were strings, so a crafted untrusted non-string value from a workflow expression could be treated by the underlying mail library as a file path or URL. This could allow disclosure of local files on the n8n host. Exploitation...

Server-side Request Forgery (SSRF)

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the MCP Client. An attacker can access internal or otherwise restricted network resources by supplying crafted endpoints, causing the server to connect to unintended host...

GHSA-VHF8-CG2H-CG3P n8n: SSRF Protection Bypass via MCP Client Node

Impact On an n8n instance with SSRF protection enabled, the MCP Client node sent requests to a user-supplied endpoint without routing them through that protection and without pinning the resolved address. An authenticated user who could create or edit a workflow could therefore cause the server t...

n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Impact Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required. By supplying an absolute URL in the routing configuration, a caller could override the node type's declared baseURL,...

NPM: n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

NPM: n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

GHSA-9W78-79Q7-R4FP n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Impact Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required. By supplying an absolute URL in the routing configuration, a caller could override the node type's declared baseURL,...

GO-2026-6038 Gitea: Two SSRF findings in gitea.dev

Gitea: Two SSRF findings in gitea.dev...

GO-2026-6023 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses in github.com/cloudreve/Cloudreve

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses in github.com/cloudreve/Cloudreve...

GO-2026-6030 Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter in code.gitea.io/gitea...

CVE-2026-13071

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

CVE-2026-13066

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...

UBUNTU-CVE-2026-13066

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...

UBUNTU-CVE-2026-13071

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

UBUNTU-CVE-2026-13078

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

CVE-2026-13066

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...

Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...