#cwe-918

共收录 2042 条相关情报。

漏洞预警2026-05-09 发布CRITICAL

Linkwarden is a self-hosted, open-source collaborative bookmark manager to collect, organize and archive webpages. Prior to version 2.13.0, a Server-Side Request Forgery (SSRF) ...

CVE-2026-44313

Linkwarden（自托管开源协作书签管理器）2.13.0之前版本存在服务器端请求伪造（SSRF）漏洞。漏洞位于fetchTitleAndHeaders函数中，由于URL验证不充分（仅检查是否以"http://"或"https://"开头

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-08 发布HIGH

FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authenticated users ...

CVE-2026-44286

FastGPT 是一个 AI Agent 构建平台。在版本 4.14.17 之前，存在一个未认证的服务端请求伪造（SSRF）漏洞（CVE-2026-44286）。该漏洞位于 lafModule 工作流节点的 fetchData 函数中，该函

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-08 发布MEDIUM

FastGPT is an AI Agent building platform. Prior to version 4.14.17, FastGPT had an inconsistent SSRF protection gap in MCP tool URL handling. The direct MCP preview/run endpoint...

CVE-2026-44284

FastGPT是一个AI智能体构建平台。在版本4.14.17之前，FastGPT的MCP工具URL处理存在不一致的SSRF防护漏洞。具体来说，直接MCP预览/运行端点已拒绝内部/私有网络URL，但MCP工具创建/更新端点仍可保存内部MCP服

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-08 发布INFO

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subsc...

CVE-2026-42352

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-08 发布INFO

Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added in v2.21.4–v2.21.6 share a fundamental TOCTOU (Time-of-Che...

CVE-2026-42346

Postiz is an AI social media scheduling tool. From version 2.16.6 to before version 2.21.7, all SSRF protections added i

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-08 发布INFO

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts blocks cloud metadata ...

CVE-2026-42345

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packa

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-08 发布INFO

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.11.9-alpha.1 and prior, the SSRF protection introduced in ...

CVE-2026-42339

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. In versions 0.1

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-08 发布INFO

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via ato...

CVE-2026-41682

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnera

历史摘要 · 未重新核验 · NVD

#cve #cwe-195 #cwe-918

漏洞预警2026-05-08 发布INFO

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, the inc "filename" directive i...

CVE-2026-42213

SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-200 #cwe-295 #cwe-918

漏洞预警2026-05-08 发布INFO

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From version 2.18.7 to before version 2.50.2, there is an auth...

CVE-2026-44694

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. From

历史摘要 · 未重新核验 · NVD

#cve #cwe-367 #cwe-918

漏洞预警2026-05-08 发布INFO

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews ima...

CVE-2026-42181

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-suppli

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-08 发布INFO

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-privileged user to create a link post through POST /api/v3/po...

CVE-2026-42180

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an authenticated low-priv

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

安全公告2026-05-08 发布INFO

Bunsink has an SSRF bypass in `validate_webhook_url`

CVE-2026-44502

## Summary Bugsink’s webhook URL validation in versions 2.1.2 and earlier could be (partially) bypassed because of a mi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-918 #severity:medium

漏洞预警2026-05-08 发布INFO

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restricted the @import and data-uri() LESS features in the custo...

CVE-2026-41887

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restric

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-918

漏洞预警2026-05-08 发布INFO

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes ...

CVE-2026-42353

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-918

漏洞预警2026-05-08 发布INFO

PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF att...

CVE-2026-44335

PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-08 发布INFO

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.21, 20.3.19, 21.2.9, a...

CVE-2026-41423

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-05-08 发布INFO

PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.4, apps/web/src/routes/skills.ts exposes an authenticated...

CVE-2026-42261

PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-693 #cwe-918

安全公告2026-05-08 发布INFO

Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to...

CVE-2026-41105

Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges ove

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-918 #severity:high

安全公告2026-05-07 发布INFO

utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

CVE-2026-44661

## Summary The `utcp-http` plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundar

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-918 #severity:medium