Wyoming < 1.10.2 SSRF via uri Query Parameter
CVE-2026-8712
Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with ne
#cwe-918
共收录 2015 条相关情报。
← 返回所有主题Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
CVE-2026-62993
When a Security policy is active, {fetch} validates the requested remote URL against the trusted_uri allowlist via Secur
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can c...
CVE-2026-84207
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticat
Heym before 0.0.98 SSRF via WebSocket endpoints
CVE-2026-84207
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticat
Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated,...
CVE-2026-84199
Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting us...
CVE-2026-84196
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authentica
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies ca...
CVE-2025-15613
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attack
Kyverno before 1.16.2 SSRF via APICall Feature
CVE-2026-84199
Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field
Kyverno before 1.18.0 Server-Side Request Forgery via apiCall
CVE-2026-84196
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authentica
Kyverno before v1.13.4 SSRF via Service Call
CVE-2025-15613
Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attack
A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/P...
CVE-2026-83744
A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the f
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the...
CVE-2026-82957
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptio
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of th...
CVE-2026-82957
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptio
Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin rights required) can m...
CVE-2026-77352
Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any a
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including privat...
CVE-2026-77351
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authentic
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment ...
CVE-2026-77348
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-3340
Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.
CVE-2026-82852
Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.
A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController...
CVE-2026-82905
A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/
Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.
CVE-2026-82852
Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side re...
CVE-2026-81889
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL up