bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api...
CVE-2026-82285
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/call
#cwe-918
共收录 2015 条相关情报。
← 返回所有主题Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list members...
CVE-2026-82289
Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab.,
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no UR...
CVE-2026-82285
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/call
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-p...
CVE-2026-82270
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lac
Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction ...
CVE-2026-82268
Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats
Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant adm...
CVE-2026-82263
Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint th
Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant ad...
CVE-2026-82262
Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that
Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndE...
CVE-2026-55245
Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated s...
CVE-2026-54745
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()`...
CVE-2026-5096
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content...
CVE-2026-82246
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fai
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs wit...
CVE-2026-82243
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint tha
Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist (DEFAULT_BLACKLIST...
CVE-2026-82241
Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.
SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time wi...
CVE-2026-82234
SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agen
Budibase Server before 3.41.3 SSRF via Query Import
CVE-2026-82246
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fai
Budibase Server before 3.41.3 SSRF with Credential Leakage
CVE-2026-82243
Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint tha
Budibase backend-core SSRF via incomplete default blacklist
CVE-2026-82241
Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.
SiYuan before v3.8.1 SSRF via DNS-Rebinding TOCTOU
CVE-2026-82234
SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agen
A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5...
CVE-2026-9491
A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote au
A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information.
CVE-2026-9491
A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote au