49483 matches found
CVE-2026-71246
Pixelfed’s Pixelfed SearchController (behind auth) is vulnerable to an authenticated SSRF via remote URL search. The vulnerable path takes a URL from remote-search parameters and fetches it server-side using ActivityPubFetchService. The validateUrl() logic only blocks literal hosts 127.0.0.1, loc...
CVE-2026-71246
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...
CVE-2026-71246 Pixelfed - Authenticated SSRF via Remote URL Search
Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...
CVE-2026-71239 DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering
DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...
CVE-2026-71239
DjangoCRM: Mass Mail rendering flaw in three code paths (message_previews.py, email_creators.py, helpers.py) uses Django Template() on user-controlled EmlMessage fields without sanitization. This enables authenticated users with mass-mail edit rights to inject Django template syntax ({{ }}, {% %}...
CVE-2026-71239 DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering
DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...
CVE-2026-71239 DjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering
DjangoCRM's massmail module renders user-controlled EmlMessage fields subject, content through Django's Template constructor with no sanitization, in at least three locations: messagepreviews.py builds an f-string embedding message.subject/message.content directly into a Template call;...
EUVD-2026-53308
Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...
CVE-2026-71235
Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...
CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine
Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...
Server-side Request Forgery (SSRF)
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the rawproxy. An attacker can...
GHSA-H7X2-H6G9-P789 MLflow AI Gateway permits SSRF through an unvalidated api_base
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
CVE-2026-17802
A side-channel information leakage flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514512198...
MAL-2026-12126 Malicious code in a.poltoradnev-package-b (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebe5bbc564bb1c441ce12acaf4d177fabcd3fe5963f3c870119ee1519abab675 On require of the package, index.js loads bridge.js which selects a platform-specific output path, fetches an opaque binary over HTTPS from Cloudflar...
EUVD-2026-53284
The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handleaction method passing user-supplied input directly to calluserfunc without an allowlist o...
EUVD-2026-53208
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
CVE-2026-71211 mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
CVE-2026-71211 mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
CVE-2026-71210
Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...
CVE-2026-71210 mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access
Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...