Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

6670 vulnerabilities reference this CWE, most recent first.

CVE-2026-119712 (GCVE-0-2026-119712)

Vulnerability from cvelistv5 – Published: 2026-10-30 15:16 – Updated: 2026-10-30 15:19
VLAI
Title
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
Summary
PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7162 records in the last 180 days details
References
Impacted products
Vendor Product Version
pipeshub-ai pipeshub-ai Affected: 0 , < 0.10.0 (semver)
    cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-25 00:00
Credits
hyderpwn
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "pipeshub-ai",
          "vendor": "pipeshub-ai",
          "versions": [
            {
              "lessThan": "0.10.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.10.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hyderpwn"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T15:19:20.964Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-mp2g-r37c-fx9q)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-mp2g-r37c-fx9q"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/pipeshub-ai/pipeshub-ai/commit/16b05ed7c4c492330046fa10753389a5a5886613"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/python/app/modules/parsers/image_parser/image_parser.py"
        },
        {
          "name": "pipeshub-ai v0.10.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/pipeshub-ai/pipeshub-ai"
        },
        {
          "name": "VulnCheck Advisory: PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/pipeshub-before-0.10.0-ssrf-via-image-urls-in-indexed-documents"
        }
      ],
      "title": "PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119712",
    "datePublished": "2026-10-30T15:16:11.556Z",
    "dateReserved": "2026-10-30T14:49:25.674Z",
    "dateUpdated": "2026-10-30T15:19:20.964Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119709 (GCVE-0-2026-119709)

Vulnerability from cvelistv5 – Published: 2026-10-30 15:16 – Updated: 2026-10-30 18:36
VLAI
Title
Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata
Summary
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 18:27 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7162 records in the last 180 days details
References
Impacted products
Vendor Product Version
goniszewski grimoire Affected: 0 , < 1.0.0 (semver)
Create a notification for this product.
Date Public
2026-10-22 00:00
Credits
hieuPenguinnn
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119709",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:27:24.502688Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:36:35.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grimoire",
          "vendor": "goniszewski",
          "versions": [
            {
              "lessThan": "1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T15:16:09.484Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #237",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/goniszewski/grimoire/issues/237"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/goniszewski/grimoire"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/goniszewski/grimoire/blob/v0.5.0/src/routes/api/fetch-metadata/%2Bserver.ts"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/goniszewski/grimoire/blob/v0.5.0/src/lib/utils/get-metadata.ts"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@hieuPenguinnn/grimoire-fetch-metadata-ssrf"
        },
        {
          "name": "VulnCheck Advisory: Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/grimoire-before-1.0.0-unauthenticated-ssrf-via-api-fetch-metadata"
        }
      ],
      "title": "Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119709",
    "datePublished": "2026-10-30T15:16:09.484Z",
    "dateReserved": "2026-10-30T14:49:24.514Z",
    "dateUpdated": "2026-10-30T18:36:35.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119575 (GCVE-0-2026-119575)

Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-10-30 13:18
VLAI
Title
ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
Summary
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7162 records in the last 180 days details
References
Impacted products
Vendor Product Version
ArcadeData arcadedb Affected: 26.8.1 , < 26.10.2 (semver)
Unaffected: 26.10.2 (semver)
Create a notification for this product.
Date Public
2026-10-15 00:00
Credits
manus-pi manus-use
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:maven/com.arcadedb/arcadedb-engine",
          "product": "arcadedb",
          "vendor": "ArcadeData",
          "versions": [
            {
              "lessThan": "26.10.2",
              "status": "affected",
              "version": "26.8.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "26.10.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "manus-pi"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "manus-use"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T13:18:13.675Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-cc88-w7hj-6h8f)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-cc88-w7hj-6h8f"
        },
        {
          "name": "VulnCheck Advisory: ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/arcadedb-26.8.1-before-26.10.2-ssrf-via-alter-database-load-csv-block-list"
        }
      ],
      "title": "ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119575",
    "datePublished": "2026-10-30T13:18:13.675Z",
    "dateReserved": "2026-10-30T10:56:15.489Z",
    "dateUpdated": "2026-10-30T13:18:13.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119549 (GCVE-0-2026-119549)

Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 16:11
VLAI
Title
Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
Summary
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.
Severity
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:11 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7162 records in the last 180 days details
References
Impacted products
Vendor Product Version
jellyfin jellyfin Affected: 0 , ≤ 12.4 (custom)
    cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-17 00:00
Credits
Abraxas Labs
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119549",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T16:11:09.213684Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T16:11:21.944Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/jellyfin/jellyfin",
          "product": "jellyfin",
          "repo": "https://github.com/jellyfin/jellyfin",
          "vendor": "jellyfin",
          "versions": [
            {
              "lessThanOrEqual": "12.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "12.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abraxas Labs"
        }
      ],
      "datePublic": "2026-10-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T11:31:01.382Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/jellyfin/jellyfin/blob/v12.4/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs#L169-L173"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/ImageController.cs#L96"
        },
        {
          "name": "GitHub Security Advisory (GHSA-cf3c-8m59-2vhx)",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-cf3c-8m59-2vhx"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://abraxaslabs.tech/research/jellyfin-svg-gzip"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/jellyfin/jellyfin"
        },
        {
          "name": "VulnCheck Advisory: Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/jellyfin-through-12.4-ssrf-via-gzip-compressed-data-uri-in-svg-profile-images"
        }
      ],
      "title": "Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119549",
    "datePublished": "2026-10-30T11:31:01.382Z",
    "dateReserved": "2026-10-30T10:53:25.542Z",
    "dateUpdated": "2026-10-30T16:11:21.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119545 (GCVE-0-2026-119545)

Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 16:09
VLAI
Title
Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
Summary
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 16:08 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7162 records in the last 180 days details
References
Impacted products
Vendor Product Version
forgejo forgejo Affected: 0 , ≤ 15.0.11 (semver)
Affected: 16.0.0 , ≤ 16.0.7 (semver)
Affected: 17.0.0 , ≤ 17.0.1 (semver)
    cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*
    cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*
    cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-12 00:00
Credits
Abraxas Labs
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119545",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T16:08:38.126087Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T16:09:53.289Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-2fcr-jfvc-vgg2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "forgejo",
          "repo": "https://codeberg.org/forgejo/forgejo",
          "vendor": "forgejo",
          "versions": [
            {
              "lessThanOrEqual": "15.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "16.0.7",
              "status": "affected",
              "version": "16.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "17.0.1",
              "status": "affected",
              "version": "17.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "15.0.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "16.0.7",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:forgejo:forgejo:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "17.0.1",
                  "versionStartIncluding": "17.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abraxas Labs"
        }
      ],
      "datePublic": "2026-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server issue requests by submitting arbitrary OpenID identifier URLs. Attackers can POST crafted identifiers to /user/login/openid to trigger blind discovery GET requests to loopback, cloud metadata, and internal addresses for port scanning and probing."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T11:30:58.642Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://codeberg.org/forgejo/forgejo/src/tag/v17.0.1/modules/auth/openid/openid.go#L35-L36"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://abraxaslabs.tech/research/forgejo-openid-discovery-ssrf"
        },
        {
          "name": "GitHub Security Advisory (GHSA-2fcr-jfvc-vgg2)",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-2fcr-jfvc-vgg2"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://codeberg.org/forgejo/forgejo"
        },
        {
          "name": "VulnCheck Advisory: Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/forgejo-through-15.0.11-16.0.7-and-17.0.1-ssrf-via-openid-discovery"
        }
      ],
      "title": "Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119545",
    "datePublished": "2026-10-30T11:30:58.642Z",
    "dateReserved": "2026-10-30T10:53:23.968Z",
    "dateUpdated": "2026-10-30T16:09:53.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119428 (GCVE-0-2026-119428)

Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
Title
phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
Summary
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.
Severity
6.3 (Medium)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7162 records in the last 180 days details
References
Impacted products
Vendor Product Version
phpMyAdmin phpMyAdmin Affected: 0 , ≤ 5.2.3 (semver)
    cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-28 00:00
Credits
Abraxas Labs Maurício Meneghini Fauth
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/phpmyadmin/phpmyadmin",
          "product": "phpMyAdmin",
          "repo": "https://github.com/phpmyadmin/phpmyadmin",
          "vendor": "phpMyAdmin",
          "versions": [
            {
              "lessThanOrEqual": "5.2.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "5.2.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abraxas Labs"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Maur\u00edcio Meneghini Fauth"
        }
      ],
      "datePublic": "2026-10-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T11:30:57.237Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/phpmyadmin/phpmyadmin/commit/510e442593af5d4702bbb46cdb45ad51f3a8a9d3"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/phpmyadmin/phpmyadmin/commit/126ac3ac5662ed3171ef3646636348fad3f8e952"
        },
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/phpmyadmin/phpmyadmin/pull/19156"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/setup/validate.php#L21-L35"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Config/Validator.php#L241"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://abraxaslabs.tech/research/phpmyadmin-setup-validate"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/phpmyadmin/phpmyadmin"
        },
        {
          "name": "VulnCheck Advisory: phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-ssrf-via-setup-validate-php-after-setup-disabled"
        }
      ],
      "title": "phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119428",
    "datePublished": "2026-10-30T11:30:57.237Z",
    "dateReserved": "2026-10-30T02:41:15.033Z",
    "dateUpdated": "2026-10-30T11:30:57.237Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119343 (GCVE-0-2026-119343)

Vulnerability from cvelistv5 – Published: 2026-10-30 20:31 – Updated: 2026-10-30 20:31
VLAI
Title
Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read
Summary
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0.
Severity
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE
  • CWE-73 - External Control of File Name or Path
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 8103 records in the last 180 days details
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Stirling-PDF",
          "vendor": "Stirling-Tools",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T20:31:48.374Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-3x7x-943g-269w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-3x7x-943g-269w"
        },
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/pull/7018",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/pull/7018"
        },
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/commit/0570c4c4d9e7bf4786a02ab770ef75f116ac3719",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/commit/0570c4c4d9e7bf4786a02ab770ef75f116ac3719"
        },
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v3.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v3.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3x7x-943g-269w",
        "discovery": "UNKNOWN"
      },
      "title": "Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119343",
    "datePublished": "2026-10-30T20:31:48.374Z",
    "dateReserved": "2026-10-29T20:44:30.287Z",
    "dateUpdated": "2026-10-30T20:31:48.374Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119342 (GCVE-0-2026-119342)

Vulnerability from cvelistv5 – Published: 2026-10-30 20:28 – Updated: 2026-10-30 20:28
VLAI
Title
Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass
Summary
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-20 - Improper Input Validation
  • CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-610 - Externally Controlled Reference to a Resource in Another Sphere
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 8103 records in the last 180 days details
References
Impacted products
Vendor Product Version
Stirling-Tools Stirling-PDF Affected: >= 2.13.1, < 2.13.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Stirling-PDF",
          "vendor": "Stirling-Tools",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.13.1, \u003c 2.13.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-610",
              "description": "CWE-610: Externally Controlled Reference to a Resource in Another Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T20:28:30.049Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-pr4g-9qp2-g8j8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-pr4g-9qp2-g8j8"
        },
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/pull/6796",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/pull/6796"
        },
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5"
        },
        {
          "name": "https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2"
        }
      ],
      "source": {
        "advisory": "GHSA-pr4g-9qp2-g8j8",
        "discovery": "UNKNOWN"
      },
      "title": "Stirling-PDF: SVG\u2192PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119342",
    "datePublished": "2026-10-30T20:28:30.049Z",
    "dateReserved": "2026-10-29T20:44:30.286Z",
    "dateUpdated": "2026-10-30T20:28:30.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119122 (GCVE-0-2026-119122)

Vulnerability from cvelistv5 – Published: 2026-10-29 15:58 – Updated: 2026-10-29 20:16
VLAI
Title
Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
Summary
Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:15 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7162 records in the last 180 days details
References
Impacted products
Vendor Product Version
unclecode crawl4ai Affected: 0 , < 0.9.5 (semver)
Unaffected: 0.9.5 (semver)
Create a notification for this product.
Date Public
2026-10-15 00:00
Credits
arpe1618 ntohidi
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119122",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T20:15:52.358200Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T20:16:29.709Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-w4xc-px5p-c32w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/crawl4ai",
          "product": "crawl4ai",
          "vendor": "unclecode",
          "versions": [
            {
              "lessThan": "0.9.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.9.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "arpe1618"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "ntohidi"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T15:58:05.930Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-w4xc-px5p-c32w)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-w4xc-px5p-c32w"
        },
        {
          "name": "VulnCheck Advisory: Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-blind-ssrf-via-cachevalidator-freshness-check"
        }
      ],
      "title": "Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119122",
    "datePublished": "2026-10-29T15:58:05.930Z",
    "dateReserved": "2026-10-29T14:25:14.745Z",
    "dateUpdated": "2026-10-29T20:16:29.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118989 (GCVE-0-2026-118989)

Vulnerability from cvelistv5 – Published: 2026-10-29 10:57 – Updated: 2026-10-29 12:36
VLAI
Title
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects
Summary
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
5.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:19 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7162 records in the last 180 days details
References
Impacted products
Vendor Product Version
WebToffee Product Import Export for WooCommerce Affected: 2.5.1 , < 2.6.8 (semver)
    cpe:2.3:a:webtoffee:product_import_export_for_woocommerce:*:*:*:*:*:wordpress:*:*
Create a notification for this product.
Date Public
2026-10-26 00:00
Credits
Sarvar Eshboyev
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T12:19:06.542480Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T12:36:53.008Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "product": "Product Import Export for WooCommerce",
          "vendor": "WebToffee",
          "versions": [
            {
              "lessThan": "2.6.8",
              "status": "affected",
              "version": "2.5.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:webtoffee:product_import_export_for_woocommerce:*:*:*:*:*:wordpress:*:*",
                  "versionEndExcluding": "2.6.8",
                  "versionStartIncluding": "2.5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Sarvar Eshboyev"
        }
      ],
      "datePublic": "2026-10-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T10:57:40.767Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Changeset 3766250",
          "tags": [
            "patch"
          ],
          "url": "https://plugins.trac.wordpress.org/changeset/3766250/"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php#L563"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php#L661"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://wordpress.org/plugins/product-import-export-for-woo/"
        },
        {
          "name": "VulnCheck Advisory: WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/webtoffee-product-import-export-for-woocommerce-2.5.1-before-2.6.8-ssrf-via-redirects"
        }
      ],
      "title": "WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-118989",
    "datePublished": "2026-10-29T10:57:40.767Z",
    "dateReserved": "2026-10-29T10:54:53.236Z",
    "dateUpdated": "2026-10-29T12:36:53.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list