vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery
CVE-2026-94039
A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /ap
#cwe-918
共收录 2015 条相关情报。
← 返回所有主题A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function...
CVE-2026-94028
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controller_group_recipe_ac...
CVE-2026-94028
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the
mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery
CVE-2026-94028
A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user...
CVE-2026-16542
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before req
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high...
CVE-2026-16542
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before req
The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request...
CVE-2026-1641
The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions
The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin p...
CVE-2026-1641
The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions
A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `...
CVE-2026-75885
A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` end
A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile p...
CVE-2026-75885
A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` end
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security...
CVE-2026-18869
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access inte
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebH...
CVE-2026-76900
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In vers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP P...
CVE-2026-18869
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access inte
Obot: Server-Side Request Forgery via remote MCP server URL
## Summary In affected versions, the URL of a remote MCP server is attacker-controlled at registration and is fetched s
LMDeploy has an SSRF bypass
### Summary The URL checking logic in lmdeploy has a logical flaw that could be bypassed by attackers, leading to SSRF a
A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Execu...
CVE-2026-93506
A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs...
CVE-2026-93597
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and
OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HT...
CVE-2026-62282
OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack int
OpenCVE: Server-Side Request Forgery (SSRF) in notifications
CVE-2026-62282
OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack int
ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
CVE-2026-93597
ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and