49591 matches found
CVE-2026-63764 LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery SSRF vulnerability in the loadhttpurl function within the connection.py media handler, where the private-IP guard validates only the original URL without re-validating hosts after HTTP redirects. An...
EUVD-2026-46410
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...
CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...
CVE-2026-46556 FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...
Gitea: SSRF via HTTP Redirect in Repository Migration
Summary Gitea 1.25.4 validates the initial URL provided to the repository migration endpoint POST /api/v1/repos/migrate and correctly blocks requests to internal addresses like 127.0.0.1 or RFC1918 ranges. However, if the initial URL points to an attacker-controlled server that responds with an...
EUVD-2026-41602
Gitea: SSRF via HTTP Redirect in Repository Migration...
GHSA-X77V-Q46J-393G Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
Summary When oauth2client UPDATEAVATAR = true is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go's default HTTP client. The URL comes from the user's OAuth/OIDC avatar value, commonly the OIDC picture claim. The affected code path calls http.Geturl without...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the ServeAttachment process. An attacker can access confidential draft release attachments by obtaining the UUID of the attachment through side channels such as API responses, browser history, log files, or shar...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization in the ServeAttachment process. An attacker can access confidential draft release attachments by obtaining the UUID of the attachment through side channels such as API responses, browser history, log files, or shar...
CVE-2026-16318 QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls
The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...
CVE-2026-16318 QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls
The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...
EUVD-2026-46402
The QUIC transport parameters extension handler in s2n-tls incorrectly uses s2nalloc instead of s2nrealloc to store the peer's transport parameters. When a TLS 1.3 connection goes through a HelloRetryRequest, the handler is called twice on the same connection. On the second call, s2nalloc zeroes...
CVE-2026-16318
The CVE-2026-16318 issue affects server-side QUIC deployments using s2n-tls, where the QUIC transport parameters extension handler uses s2n_alloc instead of s2n_realloc. During TLS 1.3 HelloRetryRequest, the handler runs twice on the same connection; on the second run it zeroes the existing point...
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
Impact guzzlehttp/psr7 did not reject URI host components containing authority delimiters /, ?, , @, or , an embedded port such as host:8080, or IPv6 brackets that do not frame the host such as ::1 or ::1. Uri::assertValidHost rejected only control characters, so these malformed hosts were...
GHSA-HVRM-45R6-MJFJ hono/jsx does not isolate context per request, leading to cross-request data disclosure
Summary hono/jsx did not isolate context values per request during server-side rendering. While an async component was suspended on await, its provided context value stayed observable to other requests rendering concurrently, so useContext could return a value from a different in-flight request...
hono/jsx does not isolate context per request, leading to cross-request data disclosure
Summary hono/jsx did not isolate context values per request during server-side rendering. While an async component was suspended on await, its provided context value stayed observable to other requests rendering concurrently, so useContext could return a value from a different in-flight request...
EUVD-2026-42326
hono/jsx does not isolate context per request, leading to cross-request data disclosure...
Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
Summary cx in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break ou...
GHSA-W62V-XXXG-MG59 Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility
Summary cx in hono/css composes class names from plain strings but marks the result as already-escaped without HTML-escaping the input. When the result is used as a JSX class attribute during server-side rendering, the value is written into the attribute unescaped, so untrusted input can break ou...