CVE-2026-92215 a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agentsdks/python/a2uiagent/src/a2ui/extensions/fileresolve/fileresolver.py of the component FileResolver. The manipulation leads to server-side request forgery. I...

CVE-2026-92215

CVE-2026-92215 affects a2ui-project a2ui versions up to 0.10.7 . The vulnerability is a Server-Side Request Forgery (SSRF) in the FileResolver component, specifically in the httpx.get function within the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py. An unaut...

CVE-2026-92215 a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agentsdks/python/a2uiagent/src/a2ui/extensions/fileresolve/fileresolver.py of the component FileResolver. The manipulation leads to server-side request forgery. I...

cve-2024-56800-poc

cve-2024-56800 POC Reference https://nvd.nist.gov/vuln/detail/CVE-2024-56800 https://github.com/firecrawl/firecrawl/commit/4d1f92f4c8c36403022428285a03621fd90d62ec https://github.com/firecrawl/firecrawl/security/advisories/GHSA-vjp8-2wgg-p734 Vulnerability Firecrawl is a web scraper that allows...

CVE-2024-39713

CVE-2024-39713: Rocket.Chat SSRF PoC Description A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. Links: https://nvd.nist.gov/vuln/detail/CVE-2024-39713 https://hackerone.com/reports/1886954 Usage root@kitploit: pip install -r requirements.tx...

CVE-2026-64849.yaml

id: CVE-2026-64849 info: name: MLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypass author: DhiyaneshDk severity: critical description: | MLflow 3.15.0 contains an information disclosure vulnerability caused by improper validation of webhook URLs allowing attackers to reach interna...

Blackash-CVE-2025-66516

🚨 CVE-2025-66516 — Critical Apache Tika Vulnerability CVSS: 10.0 | Exploit Type: XXE Injection | Risk Level: MAXIMUM 🎯 Executive Summary CVE-2025-66516 is a critical XML External Entity XXE vulnerability in Apache Tika’s core processing engine. A single malicious PDF with XFA content can trigger:...

CVE-2026-92184

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forger...

CVE-2026-64849

CVE-2026-64849 More root@kitploit: POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: Content-Type: application/json "url": "https://httpbin.org/redirect-to?url=http://169.254.169.254/latest/meta-data/", "name": "poc", "events": "action": "CREATED", "entity": "REGISTEREDMODEL" root@kitploit: POST...

CVE-2026-88592

kkFileView versions 4.2.0 and above are vulnerable to a Server-Side Request Forgery (SSRF) in the /getCorsFile cross-origin file proxy endpoint. The root cause is a parameter mismatch : TrustHostFilter validates the first non-empty parameter in a fixed priority order, while the controller only re...

CVE-2026-88592

kkFileView = 4.2.0 is vulnerable to Server-Side Request Forgery SSRF. The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: t...

CVE-2025-56563

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

CVE-2026-92775: Server-Side Request Forgery (SSRF)

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...

EUVD-2025-210923

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

CVE-2026-92569: Server-Side Request Forgery (SSRF)

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...

CVE-2025-56563

CVE-2025-56563 is a Server-Side Request Forgery (SSRF) vulnerability in sat_proxy.php of Zenith Satellite Tracker 1.0 . The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation , allowing an unauthenticated remote ...

EUVD-2026-81259

kkFileView = 4.2.0 is vulnerable to Server-Side Request Forgery SSRF. The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: t...

CVE-2026-92804: Server-Side Request Forgery (SSRF)

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

CVE-2021-26855-PoC

CVE-2021-26855-PoC PoC exploit code for CVE-2021-26855. Original code was developed by https://github.com/GreyOrder. CVE-2021-26855 ssrf simple use of golang exercises Affected version root@kitploit: Exchange Server 2013 is less than CU23 Exchange Server 2016 is less than CU18 Exchange Server 201...

CVE-2026-92184

A server-side request forgery (SSRF) vulnerability exists in ag-ui-protocol ag-ui 0.3.0 , affecting the function urllib.request.urlopen in the file integrations/aws-strands/python/src/ag_ui_strands/utils.py within the Multimodal Content component. Manipulation of the argument Value enables the fl...