Server-side Request Forgery (SSRF)

Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the fsockgetcontents process when PHP cURL is unavailable and URL uploads are used. An attacker can...

CVE-2026-81889 elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-81889: Server-Side Request Forgery (SSRF)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

CVE-2026-34750 Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...

EUVD-2022-27845

Malicious code in bioql PyPI...

Cross-Site Scripting (XSS)

quivr is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of URL uploads, allowing users to insert malicious JavaScript payloads. Attackers can use this to execute JavaScript whenever any user clicks on a link containing the payload...