Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,653

Export CSV
CVE-2026-122008

Oqtane Framework before 10.3.0 SSRF via File Upload From URL

Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-controlled url parameter to HttpClient.GetStreamAsync without validating the scheme, host, or IP address. Attackers can request internal resources such as cloud instance metadata services or localhost-bound management interfaces, save the fetched response as a file in their own user folder, and retrieve it via the download endpoint to exfiltrate sensitive internal data or enumerate internal network hosts and ports.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oqtane
Products
Oqtane Framework
CVE-2026-118679

n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2024-3183

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal key directly. For user principals, this key is a hash of a public per-principal randomly-generated salt and the user’s password. If a principal is compromised it means the attacker would be able to retrieve tickets encrypted to any principal, all of them being encrypted by their own key directly. By taking these tickets and salts offline, the attacker could run brute force attacks to find character strings able to decrypt tickets when combined to a principal salt (i.e. find the principal’s password).

CVSS 3.1 · 8.1 High EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Aus Enterprise Linux Eus and 6 more
CVE-2023-5633

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Codeready Linux Builder Codeready Linux Builder Eus and 21 more
CVE-2026-116069

NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field

NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts to read loopback, internal-network, or cloud metadata responses returned in the plan's siteEvidence JSON.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Albert-weasker
Products
Niubigeo
CVE-2026-87897

SSR Leakage of JWT Tokens in Nextcloud Whiteboard via DevTools Protocol

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard.

CVSS 3.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
Whiteboard
CVE-2026-116192

rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots

rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash root on an existing named remote via --rc-serve. Attackers can make HEAD/GET requests to attacker-chosen hosts to read responses, capture configured custom headers, or obtain valid NetStorage request signatures.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Rclone
Products
Rclone
CVE-2026-107362

Server-Side Request Forgery in Malcolm

The bundled FilePond PHP server in Malcolm's file-upload component exposes a fetch route that retrieves an arbitrary URL and returns the response to the caller. An authenticated user can exploit this server-side request forgery (SSRF) to read HTTP, HTTPS, or FTP resources reachable from the upload container. In the default basic authentication mode this affects any authenticated user.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Cisagov
Products
Malcolm
CVE-2026-65120

Server‑Side Request Forgery Leading to Information Disclosure in NVIDIA TensorRT‑LLM

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Tensorrt-llm
CVE-2026-24269

Server‑Side Request Forgery in NVIDIA TensorRT‑LLM Leading to Information Disclosure and Data Tampering

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Tensorrt-llm
CVE-2026-118174

Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment

When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Thunderbird
CVE-2026-118172

CVE-2026-118172

The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Strapi
Products
Strapi Open Source And Enterprise Headless Cms
CVE-2026-56084

Unauthenticated SSRF in Dell PowerProtect Data Domain

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Data Domain Operating System Powerprotect Data Domain
CVE-2026-118777

Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set-Cookie response headers in ordinary JavaScript objects. A malicious server could use the cookie name __proto__ so that the attacker-controlled cookie path was written as a property on Object.prototype, or use inherited names such as constructor to modify Object. An empty cookie value could use the removal path to delete an inherited Object.prototype property. Applications using forge.http directly or through forge.xhr are affected; applications that do not use forge.http are unaffected. This issue is fixed in version 1.4.1.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Digitalbazaar
Products
Forge
CVE-2026-116176

vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Vllm Vllm-project
Products
Vllm Vllm
CVE-2026-42965

Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation

A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This allows the router to proxy requests to the cloud metadata endpoint, leading to the disclosure of instance credentials and other sensitive metadata. This bypasses previous security measures for validating IP addresses.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Openshift Container Platform Openshift Router
CVE-2026-117471

User-controlled Duo host permits authenticated SSRF in Psono Server

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on port 443 and distinguish failure modes, providing an internal DNS and service-reachability oracle. Connections still required TLS certificate validation, and the flaw did not provide arbitrary protocol or port access. Unresponsive targets could also occupy a server worker until the operating-system timeout.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Esaqa
Products
Psono
CVE-2026-105967

Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter

The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ghozylab Wordpress-extensions
Products
Gallery For Social Photo Gallery For Social Photo
CVE-2026-99227

io_uring/waitid: prevent cancel reference wrap

In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: prevent cancel reference wrap io_waitid packs the cancellation state into bit 31 of ->refs and uses bits 30:0 as a 31-bit reference counter: #define IO_WAITID_CANCEL_FLAG BIT(31) #define IO_WAITID_REF_MASK GENMASK(30, 0) __io_waitid_cancel() marks a request canceled, then increments the low bits of ->refs to claim completion ownership. When another path owns the request, the increment remains even though cancellation returns false. The request remains discoverable by cancellation, so repeated failed attempts can wrap the 31-bit reference field to zero. A later cancellation can claim ownership and complete the request a second time. Use atomic_fetch_or() when setting the cancel flag and inspect the old flag value. The first cancel attempt continues to the existing ownership increment, preserving its wake and issuer handoff semantics. Later attempts see the cancel flag and return without incrementing the reference field. This makes repeated failed cancellation attempts idempotent while leaving the first-cancel state transitions unchanged.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-102722

The FTP client trusts arbitrary IP addresses in the PASV server response

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the FTP client in IPv4 passive mode opens its data connection to whatever address the server names in its 227 reply instead of the server it is talking to. A malicious FTP server can make the client connect to any host and port the device can reach, using it to scan the internal network and to deliver uploads to internal services.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Eclipse
Products
Netx Duo