CVE-2026-21294

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could bypass security features. The issue allows a high-privileged attacker to manipulate server-side requests and bypass c...

CVE-2026-21294 Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate...

EUVD-2026-11325

Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval...

Server-side Request Forgery (SSRF)

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the HTTP Node as it is used in AgentFlow and Chatflow. An attacker can access internal network resources, retrieve sensitive information, or modify and...

Server-side Request Forgery (SSRF)

Overview flowise-ui is a Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the HTTP Node as it is used in AgentFlow and Chatflow. An attacker can access internal network resources, retrieve sensitive information, or modify and delete data by supplying crafte...

GHSA-FVCW-9W9R-PXC7 Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

Description: Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges RFC 1918, localhost, or cloud metadata endpoints. This enables...

Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access

Description: Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges RFC 1918, localhost, or cloud metadata endpoints. This enables...

EUVD-2026-10930

Flowise affected by Server-Side Request Forgery SSRF in HTTP Node Leading to Internal Network Access...

CVE-2025-70027

An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive information...

Adobe Commerce 代码问题漏洞

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. Adobe Commerce suffers from a server-side request forgery vulnerability that can be exploited by an attacker to read arbitrary file systems...

CVE-2025-70027

CVE-2025-70027 is linked to a Server-Side Request Forgery in the Sunbird-Ed SunbirdEd-portal v1.13.4. The connected sources identify the affected software and the attack type (SSRF) and note that attackers can obtain sensitive information. The exact root cause details, affected components beyond ...

PT-2026-24558

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could result in a Security feature bypass. A high-privileged attacker could exploit this vulnerability to manipulate...

plunk 代码问题漏洞

Plunk is an open-source email sending and management platform developed by Plunk. Versions of Plunk prior to 0.7.0 contained code vulnerabilities. These vulnerabilities stemmed from issues with the SNS webhook handler, which had problems with server-side request forgeing attacks. This could allow...

PT-2026-24806

Name of the Vulnerable Software and Affected Versions Quill versions prior to 0.7.1 Description Quill, a tool for macOS binary signing and notarization, contains a Server-Side Request Forgery SSRF issue when retrieving Apple notarization submission logs. Exploitation requires the ability to modif...

PT-2026-24822

Summary The REST API createUser endpoint uses string-based rank checks that only block creating owner accounts, while the Dashboard API uses indexOf-based rank comparison that prevents creating users at or above your own rank. This inconsistency allows an admin to create additional admin accounts...

PT-2026-24679

CVE-2025-70027 An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive informati… https://t.co/0CdAjHLKpo...

sunbird-portal 安全漏洞

sunbird-portal is an open-source portal developed by Sunbird-ED. Version 1.13.4 of sunbird-portal contains a security vulnerability, which stems from server-side request forgery. This vulnerability could allow attackers to obtain sensitive information...

PT-2026-24840

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prescription CSS/HTML print view via patient demographics. That finding involves server-side rendering of patient names via raw PHP echo. This finding involves...

CVE-2025-70027

An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive information...

Manga/Image Translator 代码问题漏洞

Manga/Image Translator is a text-to-image translation tool developed by zyddnys’ individual developer. Beta-0.3 and earlier versions of Manga/Image Translator had code vulnerabilities. These vulnerabilities stemmed from incorrect operations on the topilimage function in the...