125 matches found
CVE-2026-110240
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding interna...
CVE-2026-110240 Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding interna...
CVE-2026-110240
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding interna...
CVE-2026-110240
The software Lancet versions through 2.3.9 is vulnerable to a Server-Side Request Forgery (SSRF) protection bypass in the netutil.IsInternalIP function. The root cause is the misclassification of IPv6 private, link-local, CGNAT, and transition addresses as external addresses. Attackers can exploi...
PT-2026-111863
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding interna...
CVE-2026-104973
Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...
PYSEC-2026-4096 MCP Atlassian: SSRF Protection Bypass
Environment - Project: sooperset/mcp-atlassian - Affected function: validateurlforssrf - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: POST /mcp - Tested version: 2.14.5 Description The SSRF protection in validateurlforssrf can be bypassed with a URL...
CVE-2026-101005
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...
CVE-2026-101005
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...
CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...
CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...
CVE-2026-101005
A server-side request forgery (SSRF) vulnerability exists in October CMS versions up to 4.3.4 . The flaw is located in the validateExternalImageHost function within the System/Classes/ResizeImages.php file of the SSRF Protection component. An unauthenticated remote attacker can exploit this vulne...
EUVD-2026-88093
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...
CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...
CVE-2026-101005: Server-Side Request Forgery (SSRF)
A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...
CVE-2026-61704
Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address...
CVE-2026-77085
n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...
CVE-2026-77069
n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...
PT-2026-78940
Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.34.1 n8n versions 2.33.x prior to 2.33.4 Description The SearXNG Agent tool contains a Server-Side Request Forgery SSRF protection bypass. This occurs because the tool utilizes a raw HTTP client to send requests to a...
PYSEC-2026-3684 ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
Summary The /admin/gateways/test endpoint validates submitted URLs by resolving the hostname at validation time and blocking private address ranges. The HTTP client independently re-resolves DNS at connection time with no IP binding between the two operations, creating a TOCTOU window exploitable...