#cwe-918

共收录 2042 条相关情报。

漏洞预警2026-06-25 发布INFO

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by set...

CVE-2026-54033

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users t

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-24 发布INFO

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and Gra...

CVE-2026-55455

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filte

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-24 发布INFO

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port 9001, reachable f...

CVE-2026-50189

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled superviso

历史摘要 · 未重新核验 · NVD

#cve #cwe-183 #cwe-918

漏洞预警2026-06-24 发布INFO

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost...

CVE-2026-49979

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send

历史摘要 · 未重新核验 · NVD

#cve #cwe-209 #cwe-918

漏洞预警2026-06-24 发布HIGH

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration functionality. The applica...

CVE-2026-52805

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exis

来源摘录 · NVD

#cve #cwe-918

漏洞预警2026-06-24 发布INFO

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in...

CVE-2026-47267

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or ru

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-24 发布INFO

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, PrivateAddressCheck.pri...

CVE-2026-47389

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when us

历史摘要 · 未重新核验 · NVD

#cve #cwe-184 #cwe-200 #cwe-918

漏洞预警2026-06-24 发布INFO

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP address ranges was lacking an IP addre...

CVE-2026-46348

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the lis

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-24 发布INFO

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request...

CVE-2026-53946

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch mis

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-24 发布INFO

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attac...

CVE-2026-53945

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP reques

历史摘要 · 未重新核验 · NVD

#cve #cwe-367 #cwe-918

漏洞预警2026-06-24 发布INFO

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the request isn't goi...

CVE-2026-53944

Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible t

历史摘要 · 未重新核验 · NVD

#cve #cwe-184 #cwe-918

漏洞预警2026-06-24 发布INFO

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions >= 2.82.0, < 2.91.0, if the HTML back...

CVE-2026-44016

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-918

漏洞预警2026-06-24 发布INFO

A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak the admin gfrestto...

CVE-2026-12986

A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All plat

历史摘要 · 未重新核验 · NVD

#cve #cwe-352 #cwe-918

漏洞预警2026-06-24 发布INFO

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the c...

CVE-2026-57303

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks,

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-24 发布INFO

Server-Side Request Forgery (SSRF) (CWE-918) in the PDF generation endpoint GET /api/reports/{id}/pdf (backend/main.py) in ccyl13 Pentestify 1.0.0 and lower allows remote attack...

CVE-2026-13150

Server-Side Request Forgery (SSRF) (CWE-918) in the PDF generation endpoint GET /api/reports/{id}/pdf (backend/main.py)

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-24 发布INFO

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for u...

CVE-2026-12100

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-24 发布INFO

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url' parameter. This makes it possible f...

CVE-2026-12095

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-24 发布INFO

The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'new_link' parameter. This makes it possib...

CVE-2026-11370

The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including,

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP proxy. Before the...

CVE-2026-53931

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequ

历史摘要 · 未重新核验 · NVD

#cve #cwe-441 #cwe-918

漏洞预警2026-06-23 发布INFO

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced ...

CVE-2026-53930

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-918