Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

6281 vulnerabilities reference this CWE, most recent first.

CVE-2026-108602 (GCVE-0-2026-108602)

Vulnerability from cvelistv5 – Published: 2026-10-10 19:54 – Updated: 2026-10-10 19:54
VLAI
Title
Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution
Summary
Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5401 records in the last 180 days details
References
Impacted products
Vendor Product Version
Helicone helicone Affected: 0 , ≤ v2025.08.21-1 (custom)
Create a notification for this product.
Date Public
2026-10-09 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/Helicone/helicone",
          "product": "helicone",
          "repo": "https://github.com/Helicone/helicone",
          "vendor": "Helicone",
          "versions": [
            {
              "lessThanOrEqual": "v2025.08.21-1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T19:54:36.258Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind/helicone-webhook-dns-ssrf"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/lib/clients/webhookSender.ts#L11-L76"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/controllers/public/webhookController.ts#L64-L85"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/Helicone/helicone"
        },
        {
          "name": "VulnCheck Advisory: Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/helicone-through-2025.08.21-1-ssrf-via-jawn-webhook-sender-dns-resolution"
        }
      ],
      "title": "Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108602",
    "datePublished": "2026-10-10T19:54:36.258Z",
    "dateReserved": "2026-10-10T19:06:37.718Z",
    "dateUpdated": "2026-10-10T19:54:36.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108594 (GCVE-0-2026-108594)

Vulnerability from cvelistv5 – Published: 2026-10-10 18:16 – Updated: 2026-10-10 18:16
VLAI
Title
Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
Summary
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
3.5 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5401 records in the last 180 days details
References
Impacted products
Vendor Product Version
mealie-recipes mealie Affected: 3.26.0 , ≤ 3.28.0 (semver)
    cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-09 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/mealie-recipes/mealie",
          "product": "mealie",
          "repo": "https://github.com/mealie-recipes/mealie",
          "vendor": "mealie-recipes",
          "versions": [
            {
              "lessThanOrEqual": "3.28.0",
              "status": "affected",
              "version": "3.26.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mealie:mealie:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.28.0",
                  "versionStartIncluding": "3.26.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider\u0027s internal address on each login."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T18:16:57.811Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind/mealie-oidc-avatar-ssrf"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mealie-recipes/mealie/blob/v3.28.0/mealie/core/security/providers/openid_provider.py#L170-L200"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mealie-recipes/mealie/blob/v3.28.0/mealie/pkgs/safehttp/transport.py#L60-L160"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/mealie-recipes/mealie"
        },
        {
          "name": "VulnCheck Advisory: Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/mealie-3.26.0-through-3.28.0-ssrf-via-oidc-picture-claim-avatar-fetch"
        }
      ],
      "title": "Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108594",
    "datePublished": "2026-10-10T18:16:57.811Z",
    "dateReserved": "2026-10-10T18:08:12.108Z",
    "dateUpdated": "2026-10-10T18:16:57.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108583 (GCVE-0-2026-108583)

Vulnerability from cvelistv5 – Published: 2026-10-10 15:57 – Updated: 2026-10-10 15:57
VLAI
Title
zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool
Summary
zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zotero_add_by_url, causing requests to loopback, private, or link-local hosts directly or via redirects, leaking citation meta-tags and error details.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5401 records in the last 180 days details
References
Impacted products
Vendor Product Version
54yyyu zotero-mcp Affected: 0.10.0 , ≤ 0.14.1 (semver)
Create a notification for this product.
Date Public
2026-10-09 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/zotero-mcp-server",
          "product": "zotero-mcp",
          "repo": "https://github.com/54yyyu/zotero-mcp",
          "vendor": "54yyyu",
          "versions": [
            {
              "lessThanOrEqual": "0.14.1",
              "status": "affected",
              "version": "0.10.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zotero_add_by_url, causing requests to loopback, private, or link-local hosts directly or via redirects, leaking citation meta-tags and error details."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T15:57:51.278Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind/zotero-mcp-generic-url-metadata-ssrf"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/54yyyu/zotero-mcp/blob/v0.14.1/src/zotero_mcp/tools/write.py#L2035-L2089"
        },
        {
          "tags": [
            "related",
            "issue-tracking"
          ],
          "url": "https://github.com/54yyyu/zotero-mcp/issues/326"
        },
        {
          "name": "VulnCheck Advisory: zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/zotero-mcp-0.10.0-through-0.14.1-ssrf-via-zotero-add-by-url-tool"
        }
      ],
      "title": "zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108583",
    "datePublished": "2026-10-10T15:57:51.278Z",
    "dateReserved": "2026-10-10T15:51:35.878Z",
    "dateUpdated": "2026-10-10T15:57:51.278Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108554 (GCVE-0-2026-108554)

Vulnerability from cvelistv5 – Published: 2026-10-10 14:49 – Updated: 2026-10-10 14:49
VLAI
Title
PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input
Summary
PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5401 records in the last 180 days details
References
Impacted products
Vendor Product Version
PDFMathTranslate PDFMathTranslate Affected: 0 , ≤ 1.9.11 (semver)
Create a notification for this product.
Date Public
2026-09-11 00:00
Credits
George Chen
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/pdf2zh",
          "product": "PDFMathTranslate",
          "vendor": "PDFMathTranslate",
          "versions": [
            {
              "lessThanOrEqual": "1.9.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-09-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T14:49:39.371Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #1188",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/PDFMathTranslate/PDFMathTranslate/issues/1188"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/PDFMathTranslate/PDFMathTranslate"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/PDFMathTranslate/PDFMathTranslate/blob/0f0618d3303d064d97e7adb77557b21236c6cee0/pdf2zh/gui.py#L149-L179"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/PDFMathTranslate/PDFMathTranslate/blob/0f0618d3303d064d97e7adb77557b21236c6cee0/pdf2zh/gui.py#L257-L269"
        },
        {
          "name": "VulnCheck Advisory: PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/pdfmathtranslate-through-1.9.11-ssrf-via-gradio-web-gui-link-input"
        }
      ],
      "title": "PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108554",
    "datePublished": "2026-10-10T14:49:39.371Z",
    "dateReserved": "2026-10-10T14:39:40.380Z",
    "dateUpdated": "2026-10-10T14:49:39.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108521 (GCVE-0-2026-108521)

Vulnerability from cvelistv5 – Published: 2026-10-11 02:45 – Updated: 2026-10-11 02:45
VLAI
Title
Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery
Summary
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration."
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
4.7 (Medium)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3678 records in the last 180 days details
References
URL Tags
https://vuldb.com/vuln/416187 vdb-entrytechnical-description
https://vuldb.com/vuln/416187/cti signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108521 third-party-advisory
https://vuldb.com/submit/893356 third-party-advisory
https://gist.github.com/jovair1994/db23594d74428d… exploit
Impacted products
Vendor Product Version
Studio-Saelix Sencho Affected: 0.97.0
Affected: 0.97.1
    cpe:2.3:a:studio-saelix:sencho:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
jpazz (VulDB User) VulDB CNA Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:studio-saelix:sencho:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Add Remote Node API Endpoint"
          ],
          "product": "Sencho",
          "vendor": "Studio-Saelix",
          "versions": [
            {
              "status": "affected",
              "version": "0.97.0"
            },
            {
              "status": "affected",
              "version": "0.97.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "jpazz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: \"The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T02:45:12.112Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416187 | Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416187"
        },
        {
          "name": "VDB-416187 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416187/cti"
        },
        {
          "name": "CVE-2026-108521 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108521"
        },
        {
          "name": "Submit #893356 | Studio-Saelix sencho \u003c= 0.94.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893356"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/jovair1994/db23594d74428d38606e8000beb867d4"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-10T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-10T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-10T14:53:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108521",
    "datePublished": "2026-10-11T02:45:12.112Z",
    "dateReserved": "2026-10-10T12:48:35.614Z",
    "dateUpdated": "2026-10-11T02:45:12.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108115 (GCVE-0-2026-108115)

Vulnerability from cvelistv5 – Published: 2026-10-10 14:15 – Updated: 2026-10-10 14:15
VLAI
Title
Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses
Summary
Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
4.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5401 records in the last 180 days details
References
Impacted products
Vendor Product Version
kortix-ai suna Affected: 0.10.7 , < 0.13.52 (semver)
Create a notification for this product.
Date Public
2026-10-09 00:00
Credits
HaiND from the Post and Telecommunication Institute of Technology
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/kortix-ai/suna",
          "product": "suna",
          "repo": "https://github.com/kortix-ai/suna",
          "vendor": "kortix-ai",
          "versions": [
            {
              "lessThan": "0.13.52",
              "status": "affected",
              "version": "0.10.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T14:15:51.603Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://hackmd.io/@haind/suna-ssrf-6to4-guard-bypass"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/kortix-ai/suna"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/kortix-ai/suna/blob/v0.13.45/apps/api/src/shared/ssrf-guard.ts#L98-L113"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kortix-ai/suna/commit/9c949e4d876cd5acf7b23b0a9ee49ca5c53f1332"
        },
        {
          "name": "Suna v0.13.52 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/kortix-ai/suna/releases/tag/v0.13.52"
        },
        {
          "name": "VulnCheck Advisory: Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kortix-suna-0.10.7-before-0.13.52-ssrf-guard-bypass-via-ipv6-6to4-addresses"
        }
      ],
      "title": "Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108115",
    "datePublished": "2026-10-10T14:15:51.603Z",
    "dateReserved": "2026-10-09T13:44:40.884Z",
    "dateUpdated": "2026-10-10T14:15:51.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107781 (GCVE-0-2026-107781)

Vulnerability from cvelistv5 – Published: 2026-10-08 20:15 – Updated: 2026-10-09 14:03
VLAI
Title
Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
Summary
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.
Severity
9.1 (Critical)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 14:03 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5401 records in the last 180 days details
References
Impacted products
Vendor Product Version
dromara skyeye Affected: 0 , ≤ 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 (git)
Create a notification for this product.
Date Public
2026-10-08 00:00
Credits
Ikram-4
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107781",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T14:03:30.638893Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T14:03:40.973Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/dromara/skyeye",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/dromara/skyeye",
          "product": "skyeye",
          "repo": "https://github.com/dromara/skyeye",
          "vendor": "dromara",
          "versions": [
            {
              "lessThanOrEqual": "003549ae5615bd114ba5bb8ddf6a8e8ead97c321",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ikram-4"
        }
      ],
      "datePublic": "2026-10-08T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user\u0027s stored file, then read results via queryFileToShowById."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T20:15:56.039Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #29",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/dromara/skyeye/issues/29"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-adm/adm-pro/src/main/java/com/skyeye/eve/diskcloud/service/impl/FileConsoleServiceImpl.java#L533-L556"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/dromara/skyeye"
        },
        {
          "name": "VulnCheck Advisory: Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/dromara-skyeye-unauthenticated-ssrf-and-file-overwrite-via-edituploadofficefilebyid"
        }
      ],
      "title": "Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-107781",
    "datePublished": "2026-10-08T20:15:56.039Z",
    "dateReserved": "2026-10-08T20:02:31.075Z",
    "dateUpdated": "2026-10-09T14:03:40.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107698 (GCVE-0-2026-107698)

Vulnerability from cvelistv5 – Published: 2026-10-08 17:30 – Updated: 2026-10-08 17:51
VLAI
Title
FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
Summary
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 17:51 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 5401 records in the last 180 days details
References
Impacted products
Vendor Product Version
FFmpeg FFmpeg Affected: 0 , < 7.1.4 (semver)
Affected: 8.0 , < 8.0.2 (custom)
    cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
    cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-02-27 00:00
Credits
BapToutatis
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107698",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:51:17.969183Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:51:31.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/ffmpeg/ffmpeg",
          "product": "FFmpeg",
          "repo": "https://code.ffmpeg.org/FFmpeg/FFmpeg",
          "vendor": "FFmpeg",
          "versions": [
            {
              "lessThan": "7.1.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.0.2",
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "8.0.2",
                  "versionStartIncluding": "8.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "BapToutatis"
        }
      ],
      "datePublic": "2026-02-27T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T17:30:28.683Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9"
        },
        {
          "name": "Backport to release/7.1",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/7c011995e394"
        },
        {
          "name": "Backport to release/8.0",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/FFmpeg/FFmpeg"
        },
        {
          "name": "VulnCheck Advisory: FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"
        }
      ],
      "title": "FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-107698",
    "datePublished": "2026-10-08T17:30:28.683Z",
    "dateReserved": "2026-10-08T16:51:40.447Z",
    "dateUpdated": "2026-10-08T17:51:31.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107449 (GCVE-0-2026-107449)

Vulnerability from cvelistv5 – Published: 2026-10-08 04:28 – Updated: 2026-10-08 17:35
VLAI
Summary
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
Severity
3.4 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 17:34 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
mitre CNA under the mitre root
CNA scorecard E 27/100 over 2318 records in the last 180 days details
References
Impacted products
Vendor Product Version
linuxserver Heimdall Affected: 0 , ≤ 2.8.3 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107449",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:34:52.742208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:35:00.370Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Enhanced app test/livestats (test_config",
            "get_stats)"
          ],
          "product": "Heimdall",
          "programFiles": [
            "app/SupportedApps.php",
            "app/Http/Controllers/ItemController.php"
          ],
          "programRoutines": [
            {
              "name": "SupportedApps::execute"
            }
          ],
          "repo": "https://github.com/linuxserver/Heimdall",
          "vendor": "linuxserver",
          "versions": [
            {
              "lessThanOrEqual": "2.8.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T04:28:17.619Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "technical-description"
          ],
          "url": "https://github.com/kashishtopi/heimdall-unauth-ssrf"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/linuxserver/Heimdall/blob/9ad5864a80d7025db1e6eab8eb2981c165b0ddff/app/SupportedApps.php"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-107449",
    "datePublished": "2026-10-08T04:28:17.619Z",
    "dateReserved": "2026-10-08T04:28:16.780Z",
    "dateUpdated": "2026-10-08T17:35:00.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107394 (GCVE-0-2026-107394)

Vulnerability from cvelistv5 – Published: 2026-10-08 19:55 – Updated: 2026-10-09 15:54
VLAI
Title
Indico: Incomplete Server-Side Request Forgery (SSRF) check
Summary
Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.
Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 15:54 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7595 records in the last 180 days details
References
Impacted products
Vendor Product Version
indico indico Affected: < 3.3.13
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107394",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T15:54:32.591965Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T15:54:49.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "indico",
          "vendor": "indico",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.3.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T19:55:07.839Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/indico/indico/security/advisories/GHSA-2v95-h47v-g4x9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/indico/indico/security/advisories/GHSA-2v95-h47v-g4x9"
        },
        {
          "name": "https://github.com/indico/indico/pull/7573",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/indico/indico/pull/7573"
        },
        {
          "name": "https://github.com/indico/indico/commit/44540e70ab4e20a12f14ddba5218a33749a86736",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/indico/indico/commit/44540e70ab4e20a12f14ddba5218a33749a86736"
        },
        {
          "name": "https://github.com/indico/indico/releases/tag/v3.3.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/indico/indico/releases/tag/v3.3.13"
        }
      ],
      "source": {
        "advisory": "GHSA-2v95-h47v-g4x9",
        "discovery": "UNKNOWN"
      },
      "title": "Indico: Incomplete Server-Side Request Forgery (SSRF) check"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107394",
    "datePublished": "2026-10-08T19:55:07.839Z",
    "dateReserved": "2026-10-07T21:07:54.989Z",
    "dateUpdated": "2026-10-09T15:54:49.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list