#cwe-918

共收录 2042 条相关情报。

← 返回所有主题

漏洞预警2026-05-19 发布INFO

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host overrid...

CVE-2026-33637

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-19 发布INFO

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrasca...

CVE-2026-47358

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-610 #cwe-918

漏洞预警2026-05-19 发布INFO

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/...

CVE-2026-47357

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the rem

历史摘要 · 未重新核验 · NVD

#cve #cwe-73 #cwe-610 #cwe-918

漏洞预警2026-05-19 发布INFO

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/loc...

CVE-2026-47356

Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in the fi

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-19 发布INFO

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which...

CVE-2026-31910

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Us

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-19 发布INFO

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to u...

CVE-2026-29226

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects A

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-19 发布INFO

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.1.0 through 0.6.51, SendEmailBlock in a...

CVE-2026-33234

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-05-18 发布INFO

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows...

CVE-2026-45245

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

漏洞预警2026-05-18 发布INFO

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links...

CVE-2026-45245

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch

历史摘要 · 未重新核验 · NVD

#cve #cwe-918 #cwe-940

安全公告2026-05-18 发布INFO

Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

CVE-2026-45298

## Summary In a default dozzle deploy (the documented quickstart, no `DOZZLE_AUTH_PROVIDER` set), `POST /api/notificati

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-918 #severity:high

安全公告2026-05-18 发布INFO

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when...

CVE-2026-6333

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response UR

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:low

漏洞预警2026-05-18 发布INFO

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticate...

CVE-2026-6333

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response UR

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-05-18 发布INFO

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the fil

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

漏洞预警2026-05-17 发布INFO

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the com...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the fil

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-05-17 发布INFO

A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an...

CVE-2026-8725

A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

漏洞预警2026-05-17 发布HIGH

A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint....

CVE-2026-8725

CVE-2026-8725 是一个影响 CoreWorxLab CAAL 产品（版本 ≤ 1.6.0）的服务端请求伪造（SSRF）漏洞。该漏洞存在于文件 src/caal/webhooks.py 的未知函数中，通过 test-hass 端点

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-15 发布MEDIUM

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.5.11, there is a blind server side request forgery (SSRF) via the P...

CVE-2026-45347

Open WebUI 是一个自托管的人工智能平台，设计为完全离线运行。在版本 0.5.11 之前，其 PDF 生成功能存在盲服务器端请求伪造（SSRF）漏洞。当导出 PDF 时，用户输入被解释为 HTML 并嵌入 PDF 中。虽然脚本和某些

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-15 发布HIGH

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a Server-Side Request Forgery (SSRF) vulnerability exists in _...

CVE-2026-45338

Open WebUI 是一个自托管的人工智能平台，设计用于完全离线运行。在其 0.9.0 版本之前，后端文件 backend/open_webui/utils/oauth.py 中的 _process_picture_url() 函数（约第

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-05-15 发布INFO

CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated...

CVE-2021-47958

CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrar

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:medium

漏洞预警2026-05-15 发布INFO

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the validate_url() function in backend/open_webui/retrieval/we...

CVE-2026-45401

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the v

历史摘要 · 未重新核验 · NVD

#cve #cwe-918