CVE-2026-44202

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes th...

CVE-2026-44202

OpenAM (Open Identity Platform), an open-source IAM platform derived from ForgeRock, has an authenticated SSRF vulnerability in the /sessionservice addSessionListener operation. Prior to 16.1.1 , an authenticated user can register an arbitrary notification URL without requiring an administrative ...

CVE-2026-44202 OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes th...

CVE-2026-44202 OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes th...

CVE-2026-44202 OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an arbitrary notification URL without requiring an administrative or application client token. SessionRequestHandler passes th...

CVE-2026-27472-and-CVE-2026-27474

CVE-2026-27472 および CVE-2026-27474 CVSS-B 5.3 MEDIUM および CVSS-B 4.8 MEDIUM SPIP 4.4.8 シンジケーション機能における Blind SSRF および格納型 XSS 詳細な説明は私のウェブサイトをご覧ください PoC 1. 管理者としてログインします。 2. サイトコンテンツ 設定で、サイトの参照とシンジケーション が ウェブサイトディレクトリを管理 に設定されていることを確認します。 3. セクションに移動し、サイトを参照 をクリックします。 4. シンジケーション フィールドで シンジケーション...

CVE-2026-33712

CVE-2026-33712 - Typebot 認証されていないSSRF 説明 Typebot = 3.15.2 3.16.0で修正 には、プレビューチャットエンドポイントに認証されていない Server-Side Request Forgery SSRF 脆弱性が存在します。 エンドポイント: POST /api/v1/typebots/typebotId/preview/startChat プレビューエンドポイントは、ユーザーが指定した typebot 定義とサーバーサイドの Code ブロックを受け入れます。isolated-vm サンドボックス内で公開されている fetch...

CVE-2026-91750

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

CVE-2026-46726

CVE-2026-46726 — camel-vertx-websocket 标头注入（SSRF + 机密泄露） 针对同一 Apache Camel 漏洞的可运行概念验证（PoC）复现程序，每种运行时各一个： 运行时| 目录| 技术栈| WebSocket 数据源 ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2| 独立端口 :8090 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Came...

CVE-2026-91750 WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

CVE-2026-91750

WeKnora before 0.7.0 (developed by Tencent) is vulnerable to SSRF via unvalidated HTTP redirects. The flaw resides in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint, which fails to re-validate redirect targets after the initial SSRF check when downloading documents from user-supplied...

EUVD-2026-78232

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

CVE-2026-91750 WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

EUVD-2026-78208

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-79425

CRMEB v6.0.0 contains an authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component. An attacker with a valid account can send a crafted POST request to scan internal network resources, potentially exposing sensitive endpoints. The CNA-assigned CVSS 3.1 score i...

EUVD-2026-78625

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

PT-2026-91771

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

CVE-2026-91199

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-12944

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

CVE-2026-12944

IBM Langflow OSS 1.0.0 through 1.10.0 contains a vulnerability in its code security scanner where the DANGEROUS_IMPORTS blocklist correctly blocked subprocess but omitted the socket and urllib standard library modules. This allowed authenticated users to submit components containing socket.connec...