共收录 2042 条相关情报。
← 返回所有主题CVE-2026-45400
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, a par
CVE-2026-45331
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, valid
CVE-2021-47958
CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrar
CVE-2026-45619
CVE-2026-43884 fix `603e7bf` patched `EpgParser.php` and `plugin/AI/receiveAsync.json.php` to use `url_get_contents` (re
CVE-2026-45715
### Summary The REST datasource integration follows HTTP redirects without re-checking the IP blacklist, allowing an au
CVE-2026-45548
## Vulnerability Details **CWE-918**: Server-Side Request Forgery (SSRF) The `processUrlFile` function in `packages/se
CVE-2026-44428
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the
CVE-2026-44661
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable to a blind Server-S
CVE-2026-44430
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the
CVE-2026-45366
## Summary The `@utcp/http` package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-bound
CVE-2026-45373
### Summary Although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6
CVE-2026-45310
### Summary The `fetch_url` tool validates the initial URL's resolved IP address against a restricted-IP blocklist (`is_
CVE-2026-45401
# Server-Side Request Forgery (SSRF) Bypass via HTTP Redirect Following in Web-Fetch, Image-Load, and Chat-Completion En
CVE-2026-45400
### Summary In the open-webui project, a parsing difference between the urlparse and requests libraries led to an SSRF b
CVE-2026-44589
Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.
CVE-2026-44520
Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit sema
CVE-2026-44515
Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, Nextcloud News allows authenticated users to add feed
CVE-2026-42597
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the /forms/chromium/convert/url and /forms/c
CVE-2026-42596
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, the default deny-lists used by Gotenberg's d
CVE-2026-42595
Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, Gotenberg's Chromium URL-to-PDF endpoint (/f