Lucene search
+L

14176 matches found

NVD
NVD
added 2026/09/15 8:17 p.m.8 views

CVE-2026-76680

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery SSRF attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WA...

8.5CVSS0.00285EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 8:13 p.m.6 views

CVE-2026-37197

CVE-2026-37197 - Falsificación de Solicitud del Lado del Servidor SSRF en NukeViet CMS v4.5.07 Resumen Existe una vulnerabilidad de Falsificación de Solicitud del Lado del Servidor SSRF en VINADES JSC NukeViet CMS v4.5.07 dentro de la función de carga remota del administrador. El problema permite...

6.2AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 8:11 p.m.3 views

CVE-2026-86259

CVE-2026-86259 - OpenMAIC 1.0.0: SSRF saliente no autenticada al servicio de metadatos en la nube mediante middleware fail-open y omisión de validación condicionada por el entorno Descripción general Verificado. Existe una cadena de explotación de dos tramos en el middleware de autenticación de...

9CVSS6.1AI score0.00254EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 7:53 p.m.12 views

cve-2026-40072-ssrf-lab

Laboratorio SSRF CVE-2026-40072 Laboratorio local práctico para demostrar CVE-2026-40072 en web3.py, mostrar el impacto de SSRF en Burp Suite y verificar la corrección oficial. Resumen Este repositorio contiene una prueba de concepto segura y solo local para CVE-2026-40072, un problema de...

7.2CVSS5.9AI score0.00229EPSS
SaveExploits2
OSV
OSV
added 2026/09/15 7:49 p.m.8 views

CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

2.1CVSS5.8AI score
SaveExploits0References4
CVE
CVE
added 2026/09/15 7:49 p.m.11 views

CVE-2026-18424

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

7.1CVSS5.8AI score0.00326EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/09/15 7:49 p.m.28 views

CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

2.1CVSS0.00326EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/15 7:40 p.m.7 views

CVE-2026-76820 OpenCTI: Synchronizer SSRF: stream fetch has no URL validation

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

7.7CVSS5.8AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/15 7:40 p.m.25 views

CVE-2026-76820 OpenCTI: Synchronizer SSRF: stream fetch has no URL validation

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

7.7CVSS0.00304EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/15 7:40 p.m.6 views

EUVD-2026-79241

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

7.7CVSS5.8AI score0.00304EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/15 7:40 p.m.14 views

CVE-2026-76820

OpenCTI, an open-source cyber threat intelligence platform, is affected by a Server-Side Request Forgery (SSRF) in the synchronizerFetch GraphQL query prior to version 7.260701.0 . The backend's fetchRemoteStreams function validated only the HTTP/HTTPS scheme without applying the ingestion deny l...

7.7CVSS5.8AI score0.00304EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/15 7:23 p.m.10 views

EUVD-2026-79206

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery SSRF attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WA...

8.5CVSS5.8AI score0.00285EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/15 7:23 p.m.27 views

CVE-2026-76680 Authenticated Server-Side Request Forgery Vulnerabilities Leading to Information Disclosure in EdgeConnect SD-WAN Orchestrator

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery SSRF attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WA...

8.5CVSS0.00285EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/15 7:17 p.m.9 views

CVE-2026-90971

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

6.5CVSS0.0021EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/15 7:07 p.m.12 views

CVE-2026-90971

A Server-Side Request Forgery (SSRF) vulnerability in the VMware synchronization feature of Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection defini...

6.5CVSS5.7AI score0.0021EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/15 7:07 p.m.27 views

CVE-2026-90971

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

0.0021EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/15 6:17 p.m.11 views

CVE-2026-58485

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

7.1CVSS0.00135EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/15 6:17 p.m.7 views

CVE-2026-54688

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

6.5CVSS0.00358EPSS
SaveExploits0References4
NVD
NVD
added 2026/09/15 6:17 p.m.10 views

CVE-2026-54689

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...

6.3CVSS0.00134EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/15 6:03 p.m.10 views

CVE-2016-4014

CVE-2016-4014 SAP Netweaver JAVA AS UDDI Component XXE root@kitploit: POST /uddi/api/replication HTTP/1.1 Host: host Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78.0 Content-Type:...

9CVSS8AI score0.0691EPSS
SaveExploits2
Rows per page
Query Builder