#cwe-918

共收录 2014 条相关情报。

← 返回所有主题
漏洞预警2026-09-28 发布INFO

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supp...

CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup d

历史摘要 · 未重新核验 · NVD

安全公告2026-09-28 发布INFO

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

CVE-2026-101913

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-28 发布INFO

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

CVE-2026-101910

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, th

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-28 发布INFO

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server down...

CVE-2026-55096

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools acce

历史摘要 · 未重新核验 · NVD

安全公告2026-09-28 发布INFO

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

CVE-2026-101898

Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup d

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-28 发布INFO

Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen d...

CVE-2026-82375

Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a we

历史摘要 · 未重新核验 · NVD

安全公告2026-09-28 发布INFO

Apache Roller: Server-side request forgery via entry trackback and enclosure URLs

CVE-2026-82375

Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a we

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-28 发布INFO

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Pr...

CVE-2026-101005

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-28 发布INFO

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary ...

CVE-2026-100750

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets

历史摘要 · 未重新核验 · NVD

安全公告2026-09-28 发布INFO

October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

CVE-2026-101005

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-28 发布INFO

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.ph...

CVE-2026-100909

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathFor

历史摘要 · 未重新核验 · NVD

安全公告2026-09-28 发布INFO

OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery

CVE-2026-100909

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathFor

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-28 发布INFO

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this...

CVE-2026-100901

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function s

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-28 发布INFO

A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0...

CVE-2026-100900

A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the f

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-28 发布INFO

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability...

CVE-2026-100893

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_gra

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-28 发布INFO

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of ...

CVE-2026-100901

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function s

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-28 发布INFO

A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function updateJiraProjects of the file /jira-import of th...

CVE-2026-100900

A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the f

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-28 发布INFO

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_graph::fetch of the file src/api/resource.rs of the componen...

CVE-2026-100893

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_gra

历史摘要 · 未重新核验 · NVD

安全公告2026-09-27 发布INFO

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable...

CVE-2026-101087

Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS web

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-27 发布INFO

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server...

CVE-2026-101064

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows p

历史摘要 · 未重新核验 · GitHub Advisory