CVE-2026-93903

LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...

CVE-2026-93903

LiteSpeed Web Server (LSWS) versions prior to 6.3.7 build 1 are vulnerable to a flaw where the software mishandles internal redirect URL validation during specific "corner case" scenarios. This vulnerability could lead to significant impact as indicated by its CRITICAL severity rating (CVSS 4.0 s...

CVE-2025-63571

説明 AIシステム（ChatGPT GPT-5）の分析中に、サーバーサイドリクエストフォージェリ（SSRF）の脆弱性が発見されました。この問題は、アプリケーションがユーザーから送信された外部URL（例：ウェブフック）を、検証やサニタイズを行わずに自動的に取得・実行するために発生します。 この欠陥を悪用することで、攻撃者はAIサーバーに内部または外部システムへの任意のHTTPリクエストを強制的に実行させることができます。この振る舞いにより、サーバーの実際のIPアドレス、HTTPヘッダー、内部サービス、そして潜在的にクラウドメタデータなどの機密情報が漏洩します。 影響を受けるエンドポイント...

CVE-2026-92222

The Joomla! Core software versions 4.0.0-5.4.8 and 6.0.0-6.1.3 are vulnerable to Server-Side Request Forgery (SSRF) . The root cause is improper validation of URLs used for server-side requests within various core extensions. This vulnerability allows an attacker to potentially induce the server ...

CVE-2023-40037

CVE-2023-40037：Apache NiFi 中 JDBC 和 JNDI 连接 URL 的验证不完整 Apache NiFi 1.21.0 至 1.23.0 在多个处理器和控制器服务中支持 JDBC 和 JNDI JMS 访问，其连接 URL 验证无法针对精心构造的输入提供充分保护。已通过身份验证并获得授权的用户可以使用自定义输入格式绕过连接 URL 验证。修复方案增强了连接 URL 验证，并引入了对其它相关属性的验证。建议升级到 Apache NiFi 1.23.1 以进行缓解。 供应商披露： 此漏洞的供应商披露和修复可在此处找到。 要求： 此漏洞需要： 有效的用户凭据 概念验...

Security Bulletin: Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

Summary Langflow contains multiple Server-Side Request Forgery vulnerabilities across several components where authenticated users can supply attacker-controlled URLs or database connection strings that reach internal network hosts without adequate validation. The LMStudio model and embeddings...

CVE-2026-101061

The utcp-gql and utcp-websocket libraries, in versions before 1.1.1 , are vulnerable to server-side request forgery (SSRF) . The vulnerability stems from an incomplete application of fixes for CVE-2026-44661. Specifically, the GraphQL plugin utilizes a flawed prefix check that allows bypasses usi...

CVE-2026-101061 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

CVE-2026-101061 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

EUVD-2026-87984

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the librar...

CVE-2026-100849

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

CVE-2026-100849 AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

EUVD-2026-87474

OpenClaw versions before 2026.8.1 fail to validate video asset URLs returned by providers, allowing server-side requests to private destinations. A malicious or compromised provider can return private or loopback URLs to cause the CLI to make requests to internal services accessible from the...

CVE-2026-96443 Apache Doris: JDBC driver URL validation bypass leads to remote code execution

Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE...

EUVD-2026-85034

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses...

PT-2026-95914

Name of the Vulnerable Software and Affected Versions Import and export users and customers WordPress plugin versions prior to 2.4.5 Description High-privileged users can perform Server-Side Request Forgery SSRF attacks during a CSV import. This occurs because the plugin fails to validate a...

CVE-2026-92973

A flaw was found in ansi2html. This cross-site scripting XSS vulnerability exists in the OSC 8 hyperlink handling, where the component fails to properly validate or escape URL targets. A remote attacker, by controlling ANSI text input, can inject malicious JavaScript schemes or manipulate href...

CVE-2026-76559

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

CVE-2026-76559

The WP Import Export Lite WordPress plugin, in versions prior to 3.9.33 , is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is the failure to properly validate URLs during the import process , allowing users with the import capability (such as administrators) to force the sit...

EUVD-2026-80183

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...