#cwe-918

共收录 2015 条相关情报。

漏洞预警2026-09-15 发布INFO

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redirects whi...

CVE-2026-63443

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10

历史摘要 · 未重新核验 · NVD

#cve #cwe-863 #cwe-918

漏洞预警2026-09-15 发布INFO

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses di...

CVE-2026-58201

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues get_headers() calls guarded only by format...

CVE-2026-91967

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL functi

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-controlled HTTP Host head...

CVE-2026-91966

AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without ...

CVE-2026-91943

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attack...

CVE-2026-91938

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:cre...

CVE-2026-91935

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured...

CVE-2026-77866

Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reac

历史摘要 · 未重新核验 · NVD

#cve #cwe-636 #cwe-918

漏洞预警2026-09-15 发布INFO

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0...

CVE-2026-59973

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 a

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote...

CVE-2026-58196

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and p...

CVE-2026-55864

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tool

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-controlled host, port...

CVE-2026-55591

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in sr

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utili...

CVE-2026-54450

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require...

CVE-2026-54077

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/quer

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-776 #cwe-918

漏洞预警2026-09-15 发布INFO

An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST ...

CVE-2026-79425

An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker...

CVE-2026-54637

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the schedule

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space ...

CVE-2026-53957

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-ser

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/pyload/core/utils/web/check.py relies on Python's global-a...

CVE-2026-48737

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, is_global_address in src/p

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without a...

CVE-2026-91923

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoin

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-09-15 发布INFO

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user to register an a...

CVE-2026-44202

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListene

历史摘要 · 未重新核验 · NVD

#cve #cwe-918