A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function...

CVE-2026-17458

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file s

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser C...

CVE-2026-17458

CVE-2026-17458 存在于 mf-yang 开发的 openclaw-cn 项目（版本 ≤0.2.1）的浏览器控制 HTTP API 组件中。具体漏洞位于 src/browser/routes/agent.act.ts 文件内的

历史摘要 · 未重新核验 · NVD

mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery

CVE-2026-17458

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file s

历史摘要 · 未重新核验 · OSV.dev

FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller

## Summary The OpenAPI adapter's spec-change **poller** (`OpenApiSpecPoller`) re-fetched the configured spec `url` on a

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

## Summary Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept a

历史摘要 · 未重新核验 · GitHub Advisory

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplie

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

# Budibase: SSRF via bare fetch() in uploadUrl during AI table generation ## Summary The `uploadUrl()` function in `pa

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: SSRF via DNS rebinding in the REST datasource integration

### Summary Budibase's central outbound-fetch guard (`fetchWithBlacklist`) prevents SSRF/DNS-rebinding by resolving the

历史摘要 · 未重新核验 · GitHub Advisory

Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution

## Impact A builder-level user can make Budibase issue server-side HTTP requests to loopback or private-network targets

历史摘要 · 未重新核验 · GitHub Advisory

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

CVE-2026-59221

AI assistance was used to help inspect the code and prepare this report. ## Summary The fix for GHSA-r2wg-2mcr-66rv is

历史摘要 · 未重新核验 · GitHub Advisory

Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate...

CVE-2026-56167

Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network

历史摘要 · 未重新核验 · GitHub Advisory

9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web...

CVE-2026-63313

9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The end

历史摘要 · 未重新核验 · GitHub Advisory

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

CVE-2026-59931

### Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the `WEBSERVICE()` formula function can be bypa

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Server-Side Request Forgery in Server Actions on custom servers

CVE-2026-64649

## Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

CVE-2026-64645

## Impact A `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled in

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

## Impact The n8n Send Email node did not enforce that its message fields were strings, so a crafted untrusted non-stri

历史摘要 · 未重新核验 · GitHub Advisory

n8n: SSRF Protection Bypass via MCP Client Node

## Impact On an n8n instance with SSRF protection enabled, the MCP Client node sent requests to a user-supplied endpoin

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

CVE-2026-65593

## Impact Endpoints in `/rest/dynamic-node-parameters/` lacked authorization scopes, making it reachable by any authent

历史摘要 · 未重新核验 · GitHub Advisory

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to t...

CVE-2026-13192

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PD

历史摘要 · 未重新核验 · NVD

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Aut...

CVE-2026-65593

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node

来源摘录 · NVD