Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
CVE-2026-104973
Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP address
#cwe-918
共收录 2014 条相关情报。
← 返回所有主题In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which ca...
CVE-2026-86671
In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an
auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and ho...
CVE-2026-12171
auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the aut
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload p...
CVE-2026-102777
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension <
auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF
CVE-2026-12171
auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the aut
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-...
CVE-2026-92931
CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 thro
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read t...
CVE-2026-63269
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a doc...
CVE-2026-63267
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a lin
A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the componen...
CVE-2026-105290
A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/In
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataContr...
CVE-2026-105263
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of
Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery
CVE-2026-105263
A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback ...
CVE-2026-105238
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of t
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to chec...
CVE-2026-105301
A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access managemen
ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery
CVE-2026-105238
A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of t
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers...
CVE-2026-105214
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server requ
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown...
CVE-2026-105148
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shar
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP v...
CVE-2026-105214
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server requ
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Complet...
CVE-2026-105148
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shar
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification
CVE-2026-105214
Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server requ
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers...
CVE-2026-105122
OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modi