#cwe-918

共收录 2014 条相关情报。

漏洞预警2026-10-29 发布MEDIUM

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_...

CVE-2026-119122

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API cl

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system...

CVE-2026-104331

IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticat

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system...

CVE-2026-104315

IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticat

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布MEDIUM

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.

CVE-2026-104310

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布HIGH

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

CVE-2026-102590

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布INFO

Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to m...

CVE-2026-113688

Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布MEDIUM

Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified ...

CVE-2026-71569

Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布MEDIUM

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to...

CVE-2026-118989

WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布HIGH

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions...

CVE-2026-111418

A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-29 发布MEDIUM

A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in s...

CVE-2026-118586

A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the fi

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-918 #severity:medium

漏洞预警2026-10-28 发布MEDIUM

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to ser...

CVE-2026-118577

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the c

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-918 #severity:low

漏洞预警2026-10-28 发布HIGH

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts caller-controlled destinations after o...

CVE-2026-61572

AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/func

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布INFO

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `...

CVE-2026-57448

Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the adm

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href U...

CVE-2026-118660

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy D

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer acc...

CVE-2026-118659

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Hap

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布MEDIUM

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint stores attacker-contr...

CVE-2026-61529

Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /f

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `...

CVE-2026-13451

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-918 #severity:high

漏洞预警2026-10-28 发布HIGH

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation const...

CVE-2025-14260

Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to reso

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-10-28 发布HIGH

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Sla...

CVE-2026-118679

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhoo

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-918 #severity:medium

漏洞预警2026-10-28 发布HIGH

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure acces...

CVE-2026-88967

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-contro

来源摘录 · NVD

#cve #cwe-20 #cwe-522 #cwe-918