n8n before 1.123.64 SSRF via Dynamic Node Parameters
CVE-2026-65593
n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoint
#cwe-918
共收录 2023 条相关情报。
← 返回所有主题Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery...
CVE-2026-65318
Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows un
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined...
CVE-2026-65317
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin mid
Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arb...
CVE-2026-65318
Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows un
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
CVE-2026-59765
### Summary Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, w
Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader
CVE-2026-65318
Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows un
Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying a...
CVE-2026-65057
Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make
mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud ...
CVE-2026-65056
mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal netw
lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata...
CVE-2026-63764
lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.webso...
CVE-2026-47695
CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in get_image_info() all...
CVE-2026-46556
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Req
Gitea: Two SSRF findings
CVE-2026-58314
| --- | --- | | Versions tested | `gitea/gitea:1.26.2` (digest `sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bf
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
CVE-2026-46556
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Req
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `spider_tools` URL validation can be bypassed ...
CVE-2026-47390
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praiso
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_reference parameter wit...
CVE-2026-15927
A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery...
CVE-2026-64626
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the en
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
## Summary Axios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallb...
CVE-2026-64626
CVE-2026-64626 是一个存在于 AVideo 视频管理系统中的服务端请求伪造（SSRF）漏洞，影响从 commit 0dbadbca 至最新 master 分支的所有版本。漏洞成因在于编码器下载-URL 流程中，存在一个未固定回
FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information
CVE-2026-51031
FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. T
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
CVE-2026-61835
### Summary The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address `0.0.0.0`.