32188 matches found
PYSEC-2026-3490 NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode Summary When netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler server.py:1427. The...
PYSEC-2026-3530 PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
Summary A Server-Side Request Forgery SSRF vulnerability in the SearxNG / searchweb search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The searxngurl argument is passed directly to requests.get with no validation of...
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
SummaryA Server-Side Request Forgery SSRF vulnerability in the SearxNG / searchweb search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The searxngurl argument is passed directly to requests.get with no validation of...
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNSResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAIWeakness: CWE-918 Server-Side Request Forgery SSRF.--- SummaryThe SSRF guard...
PYSEC-2026-3535 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI Weakness: CWE-918 Server-Side Request Forgery SSRF. --- Summary The SSRF gua...
PYSEC-2026-3531 PraisonAI: SpiderTools redirect-target SSRF protection bypass
SpiderTools redirect-target SSRF protection bypass Summary SpiderTools.scrapepage validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls requests.Session.get without disabling automatic redirects or validating redirect Location...
PraisonAI: SpiderTools redirect-target SSRF protection bypass
SpiderTools redirect-target SSRF protection bypass SummarySpiderTools.scrapepage validates the initial URL and rejects directloopback, private, link-local, metadata, and internal hostnames. It then callsrequests.Session.get without disabling automatic redirects or validatingredirect Location...
CVE-2026-65516
CVE-2026-65516 - Unauthenticated Server-Side Request Forgery in the WordPress plugin PeproDev Ultimate Invoice
EUVD-2026-48120
Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...
CVE-2026-65516
Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...
CVE-2026-65516 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...
CVE-2026-65516 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...
CVE-2026-65496
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
CVE-2026-65496 WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
EUVD-2026-48107
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
CVE-2026-65496 WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
CVE-2026-65467
CVE-2026-65467 corresponds to a Server Side Request Forgery (SSRF) vulnerability in the WordPress JetEngine plugin, affecting versions up to 3.8.11. The issue is described as SSRF in JetEngine
CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...