CVE-2026-72581

A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...

CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72581

CVE-2026-72581 describes a server-side request forgery in duhow/xiaoai-patch introduced by commit fb07049. The /auth endpoint in api/main.py uses a user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling an attacker to cause the X...

OPENSUSE-SU-2026:21546-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

OPENSUSE-SU-2026:21545-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23131-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23155-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Update to 24.18.1. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23130-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

SUSE-SU-2026:23154-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. - CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. - CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...

EUVD-2026-54961

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

Linux Distros Unpatched Vulnerability : CVE-2026-12372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function...

...[ More ]

A proof of concept exploit for a server-side request forgery vulnerability in Gitea version 1.26.4. The vulnerability affects repository migration functionality and results from insufficient validation of pull request patch URLs. Although Gitea validates the original migration URL against its...

Debian dsa-6427 : wordpress - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6427 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6427-1 [email protected] https://www.debian.org/security/...

PT-2026-69985

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.21 Mastodon versions prior to 4.5.14 Mastodon versions prior to 4.6.4 Mastodon versions prior to 4.7.0-beta.1 Description A Server-Side Request Forgery SSRF protection bypass exists in the...

CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

CVE-2026-19375

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

Server-side Request Forgery (SSRF)

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the validatenetworkurl address-policy check in nltk/pathsec.py. An attacker can make a strict-mode...

CVE-2026-19340 anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery

A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/completebackend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possibl...

EUVD-2026-54908

A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The...