#cwe-918

共收录 2023 条相关情报。

漏洞预警2026-08-13 发布INFO

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the ...

CVE-2026-19752

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affect

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-13 发布INFO

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts ...

CVE-2026-19751

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected el

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-08-13 发布INFO

Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST

CVE-2026-72855

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execu

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-08-13 发布INFO

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that...

CVE-2026-73530

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to rea

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

漏洞预警2026-08-13 发布INFO

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocke...

CVE-2026-73530

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to rea

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-13 发布INFO

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patter...

CVE-2026-72777

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-13 发布INFO

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

CVE-2026-59765

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-13 发布INFO

Repository migration SSRF via multi-answer DNS allow-list bypass

CVE-2026-58442

Repository migration SSRF via multi-answer DNS allow-list bypass

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-918

漏洞预警2026-08-13 发布INFO

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

CVE-2026-58441

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-13 发布INFO

Two SSRF findings in Gitea 1.26.2

CVE-2026-58314

Two SSRF findings in Gitea 1.26.2

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-13 发布INFO

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

CVE-2026-57894

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfil

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-13 发布INFO

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-08-13 发布INFO

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

CVE-2026-34966 · CVE-2026-59765

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-08-13 发布INFO

Repository migration SSRF via multi-answer DNS allow-list bypass

CVE-2026-58442

Repository migration SSRF via multi-answer DNS allow-list bypass

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-918

安全公告2026-08-13 发布INFO

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

CVE-2026-58441

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-08-13 发布INFO

Two SSRF findings in Gitea 1.26.2

CVE-2026-58314

Two SSRF findings in Gitea 1.26.2

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-08-13 发布INFO

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

CVE-2026-57894

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfil

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-08-13 发布INFO

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

漏洞预警2026-08-13 发布INFO

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security....

CVE-2026-49857

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implem

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-08-13 发布INFO

@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version 0.3.1, he network domain has a central SSRF authorization...

CVE-2026-49856

@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version

历史摘要 · 未重新核验 · NVD

#cve #cwe-918