Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
CVE-2026-87999
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retr
#cwe-918
共收录 2015 条相关情报。
← 返回所有主题Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
CVE-2026-87996
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlayw
Tanium addressed a server-side request forgery vulnerability in Enforce.
CVE-2026-87084
Tanium addressed a server-side request forgery vulnerability in Enforce.
Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote...
CVE-2026-87595
Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging socia
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
### Summary Nodemailer's `disableFileAccess` / `disableUrlAccess` options are a security sandbox that lets an applicati
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
CVE-2026-69361
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality...
CVE-2026-48707
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forg
InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
CVE-2026-48707
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forg
snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding pri...
CVE-2026-86735
snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule th
snipe-it before 8.7.0 SSRF via IPv6 transition address bypass
CVE-2026-86735
snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule th
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make o...
CVE-2026-73315
XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allow
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET ...
CVE-2026-86590
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passe
CVE-2026-86590
CVE-2026-86590
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passe
Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.
CVE-2026-81806
Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. Th
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and...
CVE-2026-76971
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound re...
CVE-2026-76971
Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api...
CVE-2026-86539
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoi
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied desti...
CVE-2026-86539
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoi
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the se...
CVE-2026-82757
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via...
CVE-2026-86503
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source UR