CVE-2026-22662

CVE-2026-22662 : A blind SSRF exists in prompts.chat’s Wiro media generator, exploitable by authenticated users via POST to /api/media-generate with user-controlled inputImageUrl. The vulnerability permits server-side fetches to internal networks and services, allowing data exfiltration through t...

CVE-2026-22662 prompts.chat Blind SSRF via media-generate

prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests...

CVE-2026-32186

creationtimestamp| type| source ---|---|--- 2026-04-03 20:20:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mimkawvj7q27 2026-04-06 15:42:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitm3lnmma25 2026-04-06 17:30:24+00:00| published-proof-of-concept|...

CVE-2026-3184

creationtimestamp| type| source ---|---|--- 2026-04-03 20:10:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mimjp22yf623 2026-04-07 08:01:11+00:00| seen| https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mivcqr6hze42 2026-04-14 13:10:07+00:00| seen|...

CVE-2026-35216

creationtimestamp| type| source ---|---|--- 2026-04-03 17:26:47+00:00| published-proof-of-concept| Telegram/CfZ2Rt5oDMh5hfP6-7c66YyHAz2lNtcnTrevEl4rY2ivCc 2026-04-03 18:45:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mimewx5ekf2g 2026-04-04 06:17:22+00:00| seen|...

CVE-2026-5346

A vulnerability was determined in huimeicloud hmeditor up to 2.2.3. Impacted is the function client.get of the file src/mcp-server.js of the component image-to-base64 Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attac...

CVE-2026-5470

creationtimestamp| type| source ---|---|--- 2026-04-03 16:35:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mim5nfywxa2i...

CVE-2026-25043

creationtimestamp| type| source ---|---|--- 2026-04-03 16:30:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mim5fqfxge2i...

CVE-2026-25118

immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable to credential disclosure when a user authenticates to a shared album. During the authentication process, the application transmits the album password within t...

GHSA-P8C7-HJC4-GWF8 Casdoor vulnerable to SSRF via crafted Webhook URL

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not...

EUVD-2026-18658

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not...

Casdoor vulnerable to SSRF via crafted Webhook URL

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-27655

creationtimestamp| type| source ---|---|--- 2026-04-03 15:23:03+00:00| seen| Telegram/DMrtbPbyVuvJyzUNlrr2TA99ljgvsTw1ZTHgoXyjyFD12Ec 2026-04-03 15:36:11+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mim2dsq4oj26 2026-04-04 02:20:09+00:00| seen|...

CVE-2026-5469

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-5469

CVE-2026-5469 affects Casdoor version 2.356.0, specifically the Webhook URL Handler component. A crafted manipulation can induce a server-side request forgery (SSRF) and is reportable remotely. The vulnerability involves unknown code within the Webhook URL Handler and, per disclosures, the vendor...

CVE-2026-5469

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not...

CVE-2026-4108

creationtimestamp| type| source ---|---|--- 2026-04-03 13:19:23+00:00| seen| Telegram/QqwQTSXFRfWkuAVwlsaqg6mFQm4R2dirgmJdEmZNl5G-CtQ 2026-04-04 03:00:15+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3minakyy7ft2v...

CVE-2026-5467 Casdoor OAuth Authorization Request redirect

A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. Such manipulation of the argument redirecturi leads to open redirect. It is possible to launch the attack remotely. The exploit is publicly...

CVE-2026-35414

creationtimestamp| type| source ---|---|--- 2026-04-03 09:56:02+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3milhdeiiu22d 2026-04-27 18:30:06+00:00| seen| https://t.me/truesecator/8150 2026-04-29 07:06:34+00:00| seen|...

CVE-2025-7024

creationtimestamp| type| source ---|---|--- 2026-04-03 08:10:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3milbh5f5zm2i 2026-04-03 09:15:39+00:00| published-proof-of-concept| Telegram/NBs63VM2nQ9UbXE-D7ue-jsugZ5lhQP4O69jnOBlFC7zlLQ...