#cwe-918

共收录 2014 条相关情报。

← 返回所有主题
漏洞预警2026-10-21 发布HIGH

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affect...

CVE-2026-92210

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attac

来源摘录 · NVD

漏洞预警2026-10-21 发布HIGH

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbi...

CVE-2026-92204

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. Th

来源摘录 · NVD

漏洞预警2026-10-21 发布HIGH

Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate ar...

CVE-2026-92203

Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability.

来源摘录 · NVD

漏洞预警2026-10-21 发布INFO

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can ...

CVE-2026-114493

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that vali

历史摘要 · 未重新核验 · NVD

安全公告2026-10-21 发布INFO

LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects

CVE-2026-114493

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that vali

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-21 发布INFO

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows...

CVE-2026-114080

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project me

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-21 发布INFO

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows...

CVE-2026-114076

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-21 发布INFO

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows...

CVE-2026-114074

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-21 发布INFO

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote...

CVE-2026-114062

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach intern

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-21 发布INFO

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalid...

CVE-2026-114080

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project me

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-21 发布MEDIUM

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal ho...

CVE-2026-114076

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to

来源摘录 · NVD

漏洞预警2026-10-21 发布MEDIUM

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-...

CVE-2026-114074

Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members

来源摘录 · NVD

漏洞预警2026-10-21 发布INFO

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redi...

CVE-2026-114062

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach intern

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-21 发布MEDIUM

Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destinatio...

CVE-2026-109682

Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a d

来源摘录 · NVD

漏洞预警2026-10-21 发布MEDIUM

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive ...

CVE-2026-109681

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rog

来源摘录 · NVD

漏洞预警2026-10-20 发布INFO

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname ...

CVE-2026-113728

Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-20 发布INFO

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the compon...

CVE-2026-113704

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file cr

历史摘要 · 未重新核验 · NVD

安全公告2026-10-20 发布INFO

a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery

CVE-2026-113704

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file cr

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-10-20 发布INFO

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

CVE-2026-111761

--- - **Ecosystem:** Maven - **Affected package:** `org.a2aproject.sdk:a2a-java-sdk-server-common` (push-notification d

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create...

CVE-2026-113671

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI help

历史摘要 · 未重新核验 · NVD