AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station...
CVE-2026-100849
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in
#cwe-918
共收录 2014 条相关情报。
← 返回所有主题Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91. First, the LLM image-edit i...
CVE-2026-100863
该漏洞影响 Heym 0.0.90 及更早版本，属于服务端请求伪造 (SSRF) 类型的出站访问控制缺陷，官方在 0.0.91 版本的 app/services/ssrf_guard.py 中完成了两处修复。第一处问题位于大模型图像编辑功能
heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attacke...
CVE-2026-100861
CVE-2026-100861 是 heym 项目在 0.0.105 版本之前存在的一个服务端请求伪造（SSRF）保护绕过漏洞。该漏洞的核心问题在于：heym 对集成服务（integration services）的出口流量防护（egres
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfilt...
CVE-2026-100859
CVE-2026-100859 是 Heym 应用（版本低于 0.0.106）中一个凭证外泄（credential exfiltration）漏洞，位于 POST /api/credentials/test 这一接口。该接口的设计目的是让用
heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from us...
CVE-2026-100858
heym 是一个开源的可视化工作流自动化平台（用于编排 Slack、Discord、网页抓取等任务）。在 0.0.109 之前的版本中，其 Slack、Discord 与 Crawler 三类工作流节点在发起 HTTP 请求时使用了未受保护
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backend/src/Radio/AutoDJ/QueueBuilder.php, ...
CVE-2026-100850
AzuraCast 0.23.8 之前的版本在 AutoDJ 远程播放列表抓取功能中存在服务端请求伪造（SSRF）与本地文件读取漏洞。具体位于 backend/src/Radio/AutoDJ/QueueBuilder.php 的 getM
AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl() (backend/src/Webhook/Co...
CVE-2026-100849
AzuraCast 是一款自托管的网络电台管理套件。CVE-2026-100849 影响 0.23.8 之前版本的 Webhook URL 校验逻辑：位于 backend/src/Webhook/Connector/AbstractConn
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme (Utilities\Urls::parseUserUr...
CVE-2026-100848
AzuraCast（Composer 包 azuracast/azuracast）0.23.8 之前的版本存在服务端请求伪造（SSRF）漏洞。问题根源在于其“Remote Relay（远程中继）”URL 的校验逻辑过于宽松：Utilitie
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist ...
CVE-2026-100705
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.2
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port()...
CVE-2026-100698
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/f
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF)...
CVE-2026-100696
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the option
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers...
CVE-2026-100697
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/12...
CVE-2026-100705
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.2
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure di...
CVE-2026-100698
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/f
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable to pre-authentication serve...
CVE-2026-100697
Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver (plugins/drivers/elastic.php), fi...
CVE-2026-100696
Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the option
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts for...
CVE-2026-100681
Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability
ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fetching. The preview accepts a user-su...
CVE-2026-100601
ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profil
Kyverno before 1.19.1 SSRF via legacy apiCall service executor
CVE-2026-100705
Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.2
Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex
CVE-2026-100698
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/f