#cwe-918

共收录 2014 条相关情报。

← 返回所有主题
漏洞预警2026-10-12 发布INFO

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles...

CVE-2026-109651

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and...

CVE-2026-109603

Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating target...

CVE-2026-109378

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php tha

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF)...

CVE-2026-85471

A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notif

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter direct...

CVE-2026-57143

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG prov

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenti...

CVE-2026-85963

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector fun

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布HIGH

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm cha...

CVE-2026-75888

A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF

来源摘录 · NVD

漏洞预警2026-10-12 发布INFO

Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress contro...

CVE-2026-109239

Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets una

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl re...

CVE-2026-109238

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach intern

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery vulnerability that could allow a...

CVE-2026-85952

Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a ser

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability that could allow an authentica...

CVE-2026-85951

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side req

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without s...

CVE-2026-109200

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XML

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with...

CVE-2026-93694

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insu...

CVE-2026-93693

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations a

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation l...

CVE-2026-108836

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/mo

历史摘要 · 未重新核验 · NVD

安全公告2026-10-12 发布INFO

A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the...

CVE-2026-108786

A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-10-12 发布INFO

A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is...

CVE-2026-108787

A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of th

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-10-12 发布INFO

A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corp...

CVE-2026-108787

A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of th

历史摘要 · 未重新核验 · NVD

漏洞预警2026-10-12 发布INFO

A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the file src/core/CrawlOrchestrator.ts of the component Crawl...

CVE-2026-108786

A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function run_seo_audit of the

历史摘要 · 未重新核验 · NVD

安全公告2026-10-12 发布INFO

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function...

CVE-2026-108770

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the fi

历史摘要 · 未重新核验 · GitHub Advisory