#cwe-918

共收录 2023 条相关情报。

漏洞预警2026-07-18 发布HIGH

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. A...

CVE-2025-71398

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-n

来源摘录 · NVD

#cve #cwe-918

安全公告2026-07-17 发布INFO

CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard

CVE-2026-55177

# Authenticated full-read SSRF in CloudTAK `/api/esri*` routes — user-controlled URL fetched with no IP-classification g

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-918 #severity:high

安全公告2026-07-17 发布INFO

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function...

CVE-2026-16074

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plu

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:low

漏洞预警2026-07-17 发布MEDIUM

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php ...

CVE-2026-54242

CVE-2026-54242 影响 Statamic（基于 Laravel 和 Git 的内容管理系统）的 Glide 图片代理组件。在版本 5.73.24 和 6.20.1 之前，Glide 的远程 URL 验证机制存在缺陷，位于 src

历史摘要 · 未重新核验 · NVD

#cve #cwe-367 #cwe-918

漏洞预警2026-07-17 发布HIGH

css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch...

CVE-2026-53727

CVE-2026-53727 影响 Ruby CSS 解析器 css_parser，版本 2.2.0 至 3.0.0（不含3.0.0）。漏洞位于 lib/css_parser/parser.rb 中的 CssParser::Parser#r

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-17 发布INFO

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file astrbot/dashboard/routes/plugin.py of th...

CVE-2026-16074

A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plu

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-17 发布INFO

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Locatio...

CVE-2026-50151

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completeP

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-07-17 发布INFO

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the...

CVE-2026-48978

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's

历史摘要 · 未重新核验 · NVD

#cve #cwe-319 #cwe-918

安全公告2026-07-17 发布INFO

TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard

CVE-2026-54546

### Summary `PUT /api/basemap` (the basemap import endpoint) fetches an attacker-supplied URL server-side with **no SSR

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-918 #severity:medium

安全公告2026-07-17 发布INFO

meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

CVE-2026-54549

## Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch ### Summary The `upload_

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-918 #severity:high

漏洞预警2026-07-17 发布INFO

Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitr...

CVE-2026-63096

Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-07-17 发布INFO

Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint

CVE-2026-63096

Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to ca

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

漏洞预警2026-07-17 发布INFO

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipulation of the argume...

CVE-2026-16016

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file ex

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-07-17 发布INFO

poco-ai poco-claw task.py run_task server-side request forgery

CVE-2026-16016

A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file ex

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-918

安全公告2026-07-17 发布INFO

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated...

CVE-2026-62234

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.w

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:high

安全公告2026-07-17 发布INFO

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in...

CVE-2026-62227

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

安全公告2026-07-17 发布INFO

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser...

CVE-2026-62226

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

安全公告2026-07-17 发布INFO

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A...

CVE-2026-62216

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or c

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:low

安全公告2026-07-17 发布INFO

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox...

CVE-2026-62201

OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows l

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

漏洞预警2026-07-17 发布INFO

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://,...

CVE-2026-62234

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.w

历史摘要 · 未重新核验 · NVD

#cve #cwe-918