118824 matches found
SUSE CVE-2026-54562
Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or...
SUSE CVE-2026-55431
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSIONTOKEN placeholder the...
EUVD-2026-51236
Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl...
CVE-2026-66414 Leantime Open Redirect in Login Controller via redirectUrl Parameter
Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl...
CVE-2026-66414 Leantime Open Redirect in Login Controller via redirectUrl Parameter
Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl...
CVE-2026-66414 Leantime Open Redirect in Login Controller via redirectUrl Parameter
Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl...
CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-54722
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
EUVD-2026-51232
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-54722
DSSRF (Node.js library) has a vulnerability in is_url_safe prior to version 1.0.4. The bug arises because is_url_safe strips the @ userinfo delimiter via remove_at_symbol_in_string before parsing URLs, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using t...
GHSA-CG4G-M8JX-VJV2 dssrf has an SSRF bypass with remove_at_symbol_in_string
Summary isurlsafe in v1.0.3 contains an SSRF bypass. removeatsymbolinstring is applied to the raw URL string before new URL parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked. Vulnerability In helpers.ts, isurlsafe does: ts u ...
dssrf has an SSRF bypass with remove_at_symbol_in_string
Summary isurlsafe in v1.0.3 contains an SSRF bypass. removeatsymbolinstring is applied to the raw URL string before new URL parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked. Vulnerability In helpers.ts, isurlsafe does: ts u ...
CVE-2026-57862
creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ilw4ytaebzud5...
CVE-2026-67346
creationtimestamp| type| source ---|---|--- 2026-07-30 15:49:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6y3reb6zoq65d...
CVE-2026-6540
Calico's Application Layer Policy disabled by default, which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments, encoded slashes, or repeated slashes are not correctly evaluated by Prefix path rules. Dikastes...
CVE-2026-54885
Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...
CVE-2026-67351
creationtimestamp| type| source ---|---|--- 2026-07-30 15:05:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jzb5ypjqxy4mv 2026-08-01 20:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3ms2bbbxlup2u...
CVE-2026-12722
creationtimestamp| type| source ---|---|--- 2026-07-30 14:51:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/a42jzl4lwa5jo...
EUVD-2026-50465
Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation...
GHSA-PGWH-4JJ4-QM8V Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)
Summary Numerous HTTP-emitting modules core.api.httpget, core.api.httppost, graphql.query/graphql.mutation, monitor.httpcheck, communication.slacksend, notification.discord,slack,teams.sendmessage, ai.visionanalyze anthropic path, verify.visualdiff, browser.proxyrotate, and the agent/llm inline...