EulerOS Virtualization 2.11.0 : python-urllib3 (EulerOS-SA-2026-3555)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all...

The vulnerability in the Open WebUI web interface, related to insufficient validation of requests on the server side, allows a hacker to perform an SSRF attack.

The vulnerability of the Open WebUI web interface related to insufficient validation of requests on the server side when processing the AIOHTTPCLIENTALLOWREDIRECTS parameter. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack...

CVE-2026-62282: Server-Side Request Forgery (SSRF)

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests ...

The vulnerability of the SPIP content management system, related to insufficient validation of requests on the server side, allows a hacker to execute an SSRF attack.

The vulnerability of the SPIP content management system is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

EulerOS Virtualization 2.11.1 : python-pip (EulerOS-SA-2026-3464)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third...

EulerOS Virtualization 2.11.1 : python-urllib3 (EulerOS-SA-2026-3468)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all...

Linux Distros Unpatched Vulnerability : CVE-2026-92595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer npm package nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation o...

Linux Distros Unpatched Vulnerability : CVE-2026-93384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass...

exchange_webshell_detection

此项目已停止维护 请改用微软工具： Microsoft Safety Scanner GitHub 上列出的其他检测和缓解措施：https://github.com/microsoft/CSS-Exchange/tree/main/Security 在评估影响时，我们强烈建议假设已被入侵，并预先检查所有自今年1月以来公开暴露的 MS Exchange 服务器，即使没有发现主动入侵迹象。 请注意，仅通过利用链中的 SSRF 部分（即未实现代码执行、未删除任何文件或未在 Exchange 主机上启动新进程）也有可能（且确实发生了）进行数据外泄和配置更改。...

CVE-2021-26855

CVE-2021-26855 PoC of proxylogon chain SSRFCVE-2021-26855 通过 testanull 写入文件，被 GitHub 审查下架 为什么 GitHub 会因为违反可接受使用政策而删除这个漏洞利用代码 —— 但其他大量概念验证利用程序和框架却可以？ https://github.com/rapid7/metasploit-framework 大量 CVE 漏洞利用仓库 是因为 GitHub 归微软所有吗？ 审查漏洞利用代码对安全有害，即使某个漏洞利用代码有时 会给那些本应早已修复系统的公司带来风险。 而 GitHub 开了一个坏先例。...

CVE-2021-26855

CVE-2021-26855 CVE-2021-26855，也称为Proxylogon，是Exchange中的一个服务器端请求伪造SSRF漏洞，允许攻击者发送任意HTTP请求并以Exchange服务器身份进行身份验证。根据发现该漏洞的研究人员Orange Tsai的说法，CVE-2021-26855在结合CVE-2021-27065（见下文）利用时，可实现代码执行。一个成功的利用链将允许未经身份验证的攻击者“仅通过开放的443端口在Microsoft Exchange Server上执行任意命令”。更多信息和披露时间线请访问 https://proxylogon.com。...

CVE-2026-85917

Server-side request forgery ssrf in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-85917

A server-side request forgery (SSRF) vulnerability in Azure AI Foundry allows an unauthorized, network-based attacker to elevate privileges. The CVSS 3.1 score is 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating no privileges required, low complexity, and a high confide...

CVE-2026-54734

Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can...

CVE-2026-54507

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

CVE-2026-54507

Vvveb is a CMS with page builder. Prior to 1.0.8.5 , the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled URL parameter passed to getUrl(). The validateUrl() function in system/functions.php checks only the hostname string but does not validate resolved a...

CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

DEBIAN-CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...