In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthent...

CVE-2026-7412

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validat

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation...

CVE-2026-43573

OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attackers can exploit th...

CVE-2026-43527

OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows privat

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary content. Attackers can ...

CVE-2026-43526

OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that al

历史摘要 · 未重新核验 · NVD

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.5.3 via t...

CVE-2026-2948

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Requ

历史摘要 · 未重新核验 · NVD

Axios: no_proxy bypass via IP alias allows SSRF

CVE-2026-42038

The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 12

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

CVE-2026-42043

**1. Executive Summary** This report documents an **incomplete security patch** for the previously disclosed vulnerabili

历史摘要 · 未重新核验 · GitHub Advisory

pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 /...

CVE-2026-42313

### Summary The `set_config_value()` API method (`@permission(Perms.SETTINGS)`) in `src/pyload/core/api/__init__.py` ga

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw validates Zalo outbound photo URLs through the SSRF guard

## Summary Zalo outbound photo URLs are validated through the SSRF guard. ## Affected Packages / Versions - Package: op

历史摘要 · 未重新核验 · GitHub Advisory

PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML Macro is vulnerable to Server-Side Request Forgery (SSRF)....

CVE-2026-42140

PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML M

历史摘要 · 未重新核验 · NVD

A security flaw has been discovered in pixelsock directus-mcp 1.0.0. This issue affects the function validateUrl of the file index.ts of the component MCP Interface. Performing ...

CVE-2026-7729

A security flaw has been discovered in pixelsock directus-mcp 1.0.0. This issue affects the function validateUrl of the

历史摘要 · 未重新核验 · NVD

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in...

CVE-2026-6229

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and incl

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the...

CVE-2026-7605

A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the function CommonController.u

历史摘要 · 未重新核验 · GitHub Advisory

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation o...

CVE-2026-6229

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and incl

历史摘要 · 未重新核验 · NVD

A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the function CommonController.uploadImgByHttp/HttpFileToMultipartFileUtil.httpFileToMult...

CVE-2026-7605

A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the function CommonController.u

历史摘要 · 未重新核验 · NVD

A vulnerability was determined in JeecgBoot up to 3.9.1. Affected by this issue is the function...

CVE-2026-7603

A vulnerability was determined in JeecgBoot up to 3.9.1. Affected by this issue is the function checkPathTraversalBatch

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was identified in JeecgBoot up to 3.9.1. This affects the function...

CVE-2026-7604

A vulnerability was identified in JeecgBoot up to 3.9.1. This affects the function OpenApiController.add/OpenApiControll

历史摘要 · 未重新核验 · GitHub Advisory

The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to...

CVE-2026-7049

The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to Server-Side Request Forgery

历史摘要 · 未重新核验 · GitHub Advisory

The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to,...

CVE-2026-6812

The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via

历史摘要 · 未重新核验 · GitHub Advisory

The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 12.5.0.1 via the s...

CVE-2026-7049

The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to Server-Side Request Forgery

历史摘要 · 未重新核验 · NVD