Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

6543 vulnerabilities reference this CWE, most recent first.

CVE-2026-115752 (GCVE-0-2026-115752)

Vulnerability from cvelistv5 – Published: 2026-10-23 13:03 – Updated: 2026-10-23 13:03
VLAI
Title
Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon
Summary
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI.
Severity
2.3 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
4.2 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6750 records in the last 180 days details
References
Impacted products
Vendor Product Version
SignalK signalk-server Affected: 2.28.0-beta.2 , < 2.34.0 (semver)
    cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-18 19:17
Credits
Zachariah Mithani (AploSec)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/signalk-server",
          "product": "signalk-server",
          "repo": "https://github.com/SignalK/signalk-server",
          "vendor": "SignalK",
          "versions": [
            {
              "lessThan": "2.34.0",
              "status": "affected",
              "version": "2.28.0-beta.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.34.0",
                  "versionStartIncluding": "2.28.0-beta.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani (AploSec)"
        }
      ],
      "datePublic": "2026-10-18T19:17:28.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loopback, vessel network, or cloud metadata endpoints, storing image-typed responses served back via the admin UI."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T13:03:34.217Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-7wpf-ch8f-5f4x)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-7wpf-ch8f-5f4x"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/SignalK/signalk-server/commit/535104f655304c697d535252da397948e5101dc6"
        },
        {
          "name": "signalk-server v2.34.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/SignalK/signalk-server/releases/tag/v2.34.0"
        },
        {
          "name": "VulnCheck Advisory: Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/signal-k-server-2.28.0-beta.2-before-2.34.0-ssrf-via-app-store-appicon"
        }
      ],
      "title": "Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115752",
    "datePublished": "2026-10-23T13:03:34.217Z",
    "dateReserved": "2026-10-23T12:59:07.096Z",
    "dateUpdated": "2026-10-23T13:03:34.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115729 (GCVE-0-2026-115729)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:55 – Updated: 2026-10-23 12:55
VLAI
Title
@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass
Summary
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.
Severity
8.9 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6750 records in the last 180 days details
References
Impacted products
Vendor Product Version
pdfme common Affected: 5.5.10 , < 6.2.6 (semver)
Create a notification for this product.
Date Public
2026-10-16 01:30
Credits
Zachariah Mithani (AploSec)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/%40pdfme/common",
          "product": "common",
          "repo": "https://github.com/pdfme/pdfme",
          "vendor": "pdfme",
          "versions": [
            {
              "lessThan": "6.2.6",
              "status": "affected",
              "version": "5.5.10",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani (AploSec)"
        }
      ],
      "datePublic": "2026-10-16T01:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:55:09.157Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-2rg9-wxfw-wrr7)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/pdfme/pdfme/security/advisories/GHSA-2rg9-wxfw-wrr7"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/pdfme/pdfme/commit/d03d0bc4994ce6921e152879793c5ff52c5600a6"
        },
        {
          "name": "GitHub Security Advisory (GHSA-pgx6-7jcq-2qff)",
          "tags": [
            "related",
            "vendor-advisory"
          ],
          "url": "https://github.com/pdfme/pdfme/security/advisories/GHSA-pgx6-7jcq-2qff"
        },
        {
          "name": "VulnCheck Advisory: @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/pdfme-common-5.5.10-before-6.2.6-ssrf-via-isurlsafetofetch-bypass"
        }
      ],
      "title": "@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115729",
    "datePublished": "2026-10-23T12:55:09.157Z",
    "dateReserved": "2026-10-23T11:40:38.465Z",
    "dateUpdated": "2026-10-23T12:55:09.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115411 (GCVE-0-2026-115411)

Vulnerability from cvelistv5 – Published: 2026-10-22 13:20 – Updated: 2026-10-23 13:28 X_Open Source
VLAI
Title
crawlseo before 0.2.4 Server-Side Request Forgery via Crawler
Summary
crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outbound connection, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page's title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6750 records in the last 180 days details
References
Impacted products
Vendor Product Version
crawlseo crawlseo Affected: 0.1.0 , < 0.2.4 (semver)
    cpe:2.3:a:crawlseo:crawlseo:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-22 00:00
Credits
Mansurzhan Mavlankulov
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/crawlseo/crawlseo",
          "product": "crawlseo",
          "repo": "https://github.com/crawlseo/crawlseo",
          "vendor": "crawlseo",
          "versions": [
            {
              "lessThan": "0.2.4",
              "status": "affected",
              "version": "0.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:crawlseo:crawlseo:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.2.4",
                  "versionStartIncluding": "0.1.0",
                  "vulnerable": true
                }
              ],
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mansurzhan Mavlankulov"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outbound connection, allowing a TOCTOU DNS rebinding bypass. An authenticated attacker can add a malicious domain that resolves to an internal or restricted address, trigger a crawl to reach internal services or cloud metadata endpoints like 169.254.169.254, and retrieve the fetched page\u0027s title, description, headings, status code and links through the crawl results API, enabling internal network reconnaissance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T13:28:36.246Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/crawlseo/crawlseo/commit/76e4e693de0c6b294cf1f60656800e47346f1c28"
        },
        {
          "name": "Vendor Patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/crawlseo/crawlseo/releases?page=1#release-v0.2.4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://gist.github.com/mansurmavlankulov/47cb8e183fec39a7afe599d1082a3399"
        },
        {
          "name": "VulnCheck Advisory: crawlseo before 0.2.4 Server-Side Request Forgery via Crawler",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/crawlseo-before-server-side-request-forgery-via-crawler"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "crawlseo before 0.2.4 Server-Side Request Forgery via Crawler",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-115411",
    "datePublished": "2026-10-22T13:20:01.875Z",
    "dateReserved": "2026-10-22T12:20:48.706Z",
    "dateUpdated": "2026-10-23T13:28:36.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114730 (GCVE-0-2026-114730)

Vulnerability from cvelistv5 – Published: 2026-10-22 02:09 – Updated: 2026-10-22 02:09
VLAI
Summary
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
mitre CNA under the mitre root
CNA scorecard E 29/100 over 2365 records in the last 180 days details
References
Impacted products
Vendor Product Version
Roundcube Webmail Affected: 1.6.14 , < 1.6.20 (semver)
Affected: 1.7.0 , < 1.7.5 (semver)
    cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
    cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Webmail",
          "repo": "https://github.com/roundcube/roundcubemail/",
          "vendor": "Roundcube",
          "versions": [
            {
              "lessThan": "1.6.20",
              "status": "affected",
              "version": "1.6.14",
              "versionType": "semver"
            },
            {
              "lessThan": "1.7.5",
              "status": "affected",
              "version": "1.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.6.20",
                  "versionStartIncluding": "1.6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.7.5",
                  "versionStartIncluding": "1.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit \u201cFix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96\u201d."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T02:09:40.059Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "issue-tracking",
            "third-party-advisory"
          ],
          "url": "https://bugs.debian.org/1151279"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/roundcube/roundcubemail/commit/6e1d480e730a45f29829b6a11af608d5d6eb3db6"
        },
        {
          "tags": [
            "vendor-advisory",
            "release-notes"
          ],
          "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"
        },
        {
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.7.5"
        },
        {
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/roundcube/roundcubemail/releases/tag/1.6.20"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-114730",
    "datePublished": "2026-10-22T02:09:40.059Z",
    "dateReserved": "2026-10-22T02:09:39.582Z",
    "dateUpdated": "2026-10-22T02:09:40.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114634 (GCVE-0-2026-114634)

Vulnerability from cvelistv5 – Published: 2026-10-22 01:43 – Updated: 2026-10-23 15:08
VLAI
Title
WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect
Summary
WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning via the embed-versus-video render oracle.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 14:48 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6750 records in the last 180 days details
References
Impacted products
Vendor Product Version
WWBN AVideo Affected: 0 , < 29.4.0 (semver)
Unaffected: 29.4.0 (semver)
    cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-07 00:00
Credits
AlpetGexha
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114634",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-23T14:48:06.193158Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-23T15:08:11.068Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "lessThan": "29.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "29.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "29.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "AlpetGexha"
        }
      ],
      "datePublic": "2026-10-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning via the embed-versus-video render oracle."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T01:43:35.830Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-m8q2-35pq-qrmc)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-m8q2-35pq-qrmc"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/2db920d3326729743511a27de44034b0a6c78b05"
        },
        {
          "name": "VulnCheck Advisory: WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/wwbn-avideo-before-29.4.0-blind-ssrf-via-getheadercontenttypefromurl-redirect"
        }
      ],
      "title": "WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114634",
    "datePublished": "2026-10-22T01:43:35.830Z",
    "dateReserved": "2026-10-21T21:57:36.197Z",
    "dateUpdated": "2026-10-23T15:08:11.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114620 (GCVE-0-2026-114620)

Vulnerability from cvelistv5 – Published: 2026-10-22 21:34 – Updated: 2026-10-22 21:34
VLAI
Title
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
Summary
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs and can distinguish fetch outcomes through different error responses and timing. Deployments whose custom hook already applies a secure allowlist, destination controls, and retrieval limits are not affected. The JWTAuthenticationRequest implementation in authlib/oauth2/rfc9101/authorization_server.py forwards request_uri to get_request_object() before an application-approved retrieval policy accepts the destination. This issue is fixed in version 1.9.0.
Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7734 records in the last 180 days details
References
Impacted products
Vendor Product Version
authlib authlib Affected: < 1.9.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "authlib",
          "vendor": "authlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib\u0027s RFC 9101 JWTAuthenticationRequest passes the unauthenticated, client-controlled request_uri parameter to the abstract get_request_object() hook before applying a destination or registration policy; the hook itself performs no network request, while the documentation demonstrates an unrestricted HTTP fetch. In deployments whose integrator implements that hook as an unrestricted outbound fetch, a remote attacker who knows a valid public client identifier can make the authorization server request internal, link-local, or otherwise unintended URLs and can distinguish fetch outcomes through different error responses and timing. Deployments whose custom hook already applies a secure allowlist, destination controls, and retrieval limits are not affected. The JWTAuthenticationRequest implementation in authlib/oauth2/rfc9101/authorization_server.py forwards request_uri to get_request_object() before an application-approved retrieval policy accepts the destination. This issue is fixed in version 1.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T21:34:11.909Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/authlib/authlib/security/advisories/GHSA-x4rv-c3wx-4cr8"
        },
        {
          "name": "https://github.com/authlib/authlib/pull/949",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/pull/949"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/6563f6f7a8c2f71d2f85ee7511d72a4fbae3acc0"
        },
        {
          "name": "https://github.com/authlib/authlib/commit/891e3f10ae5989176211f8be35dcc7cd40aa92c6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/commit/891e3f10ae5989176211f8be35dcc7cd40aa92c6"
        },
        {
          "name": "https://github.com/authlib/authlib/releases/tag/v1.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/authlib/authlib/releases/tag/v1.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-x4rv-c3wx-4cr8",
        "discovery": "UNKNOWN"
      },
      "title": "Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114620",
    "datePublished": "2026-10-22T21:34:11.909Z",
    "dateReserved": "2026-10-21T20:34:25.600Z",
    "dateUpdated": "2026-10-22T21:34:11.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114609 (GCVE-0-2026-114609)

Vulnerability from cvelistv5 – Published: 2026-10-22 17:18 – Updated: 2026-10-22 17:18
VLAI
Title
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
Summary
fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML <img src> values, SVG <image href> or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8.
Severity
5.8 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7734 records in the last 180 days details
References
Impacted products
Vendor Product Version
py-pdf fpdf2 Affected: < 2.8.8
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "fpdf2",
          "vendor": "py-pdf",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2\u0027s shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths supplied through FPDF.image(), FPDF.write_html() HTML \u003cimg src\u003e values, SVG \u003cimage href\u003e or xlink:href values, and template image fields. This can cause outbound requests to attacker-selected internal or external services and local file open attempts, although local content is exposed only when it is a valid supported image or SVG resource. file:// URLs are not specially handled, so the local-path case requires a raw filesystem path. This issue is fixed in version 2.8.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T17:18:22.802Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/py-pdf/fpdf2/security/advisories/GHSA-rw7v-4hrq-x6r9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/py-pdf/fpdf2/security/advisories/GHSA-rw7v-4hrq-x6r9"
        },
        {
          "name": "https://github.com/py-pdf/fpdf2/pull/1824",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/py-pdf/fpdf2/pull/1824"
        },
        {
          "name": "https://github.com/py-pdf/fpdf2/pull/1857",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/py-pdf/fpdf2/pull/1857"
        },
        {
          "name": "https://github.com/py-pdf/fpdf2/commit/0d27190a8c907e02ebe9cd881471a14d0622b432",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/py-pdf/fpdf2/commit/0d27190a8c907e02ebe9cd881471a14d0622b432"
        },
        {
          "name": "https://github.com/py-pdf/fpdf2/commit/6e23f610b7946e96e9a5dd0535dcbfbe7ac1397d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/py-pdf/fpdf2/commit/6e23f610b7946e96e9a5dd0535dcbfbe7ac1397d"
        },
        {
          "name": "https://github.com/py-pdf/fpdf2/releases/tag/2.8.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/py-pdf/fpdf2/releases/tag/2.8.8"
        }
      ],
      "source": {
        "advisory": "GHSA-rw7v-4hrq-x6r9",
        "discovery": "UNKNOWN"
      },
      "title": "fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-114609",
    "datePublished": "2026-10-22T17:18:22.802Z",
    "dateReserved": "2026-10-21T20:34:25.599Z",
    "dateUpdated": "2026-10-22T17:18:22.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114493 (GCVE-0-2026-114493)

Vulnerability from cvelistv5 – Published: 2026-10-21 17:54 – Updated: 2026-10-21 19:50
VLAI
Title
LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
Summary
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.
Severity
9.2 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 19:50 UTC
CWE
  • CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 6750 records in the last 180 days details
References
Impacted products
Vendor Product Version
LocalAI LocalAI Affected: v4.6.0 , ≤ v4.11.0 (custom)
    cpe:2.3:a:mudler:localai:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-20 15:54
Credits
Zachariah Mithani (AploSec)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114493",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T19:50:08.805954Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T19:50:15.052Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/mudler/LocalAI",
          "product": "LocalAI",
          "repo": "https://github.com/mudler/LocalAI",
          "vendor": "LocalAI",
          "versions": [
            {
              "lessThanOrEqual": "v4.11.0",
              "status": "affected",
              "version": "v4.6.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:mudler:localai:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.11.0",
                  "versionStartIncluding": "4.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani (AploSec)"
        }
      ],
      "datePublic": "2026-10-20T15:54:56.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T17:54:17.584Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/mudler/LocalAI/pull/12791"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mudler/LocalAI/blob/v4.11.0/core/gallery/gallery.go#L26-L57"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mudler/LocalAI/blob/v4.11.0/pkg/downloader/uri.go#L196-L212"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mudler/LocalAI/blob/v4.11.0/pkg/httpclient/client.go#L81-L92"
        },
        {
          "name": "VulnCheck Advisory: LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/localai-4.6.0-through-4.11.0-ssrf-guard-bypass-via-http-redirects"
        }
      ],
      "title": "LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-114493",
    "datePublished": "2026-10-21T17:54:17.584Z",
    "dateReserved": "2026-10-21T16:00:26.729Z",
    "dateUpdated": "2026-10-21T19:50:15.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114374 (GCVE-0-2026-114374)

Vulnerability from cvelistv5 – Published: 2026-10-21 19:30 – Updated: 2026-10-21 19:30 X_Open Source
VLAI
Title
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
Summary
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
4.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3941 records in the last 180 days details
References
Impacted products
Vendor Product Version
leomoon-studios wiki-go Affected: 1.9.0
Affected: 1.9.1
Unaffected: 1.9.2
    cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
mikannse (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:leomoon-studios:wiki-go:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "fetch-metadata Endpoint"
          ],
          "product": "wiki-go",
          "vendor": "leomoon-studios",
          "versions": [
            {
              "status": "affected",
              "version": "1.9.0"
            },
            {
              "status": "affected",
              "version": "1.9.1"
            },
            {
              "status": "unaffected",
              "version": "1.9.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "mikannse (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go of the component fetch-metadata Endpoint. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit is publicly available and might be used. Upgrading to version 1.9.2 will fix this issue. The name of the patch is 25498ebf5c012b870967e38eec2a1e5133fa1a83. Upgrading the affected component is recommended."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T19:30:14.688Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-424731 | leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/424731"
        },
        {
          "name": "VDB-424731 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/424731/cti"
        },
        {
          "name": "CVE-2026-114374 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-114374"
        },
        {
          "name": "Submit #1019388 | leomoon-studios wiki-go \u003c= 1.9.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1019388"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/leomoon-studios/wiki-go/security/advisories/GHSA-7q4p-98g4-pwp7"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leomoon-studios/wiki-go/commit/25498ebf5c012b870967e38eec2a1e5133fa1a83"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/leomoon-studios/wiki-go/releases/tag/v1.9.2"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/leomoon-studios/wiki-go/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-21T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-21T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-21T13:17:08.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-114374",
    "datePublished": "2026-10-21T19:30:14.688Z",
    "dateReserved": "2026-10-21T11:11:46.623Z",
    "dateUpdated": "2026-10-21T19:30:14.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114362 (GCVE-0-2026-114362)

Vulnerability from cvelistv5 – Published: 2026-10-21 19:15 – Updated: 2026-10-21 19:15 X_Open Source
VLAI
Title
HarnessRouter Targets Test Endpoint app.py server-side request forgery
Summary
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
VulDB CNA under the mitre root
CNA scorecard B 82/100 over 3941 records in the last 180 days details
References
Impacted products
Vendor Product Version
n/a HarnessRouter Affected: 0.31.0
Affected: 0.31.1
Affected: 0.31.2
Affected: 0.31.3
Affected: 0.31.4
Affected: 0.31.5
Affected: 0.31.6
Affected: 0.31.7
Affected: 0.31.8
Affected: 0.31.9
Affected: 0.31.10
Affected: 0.31.11
Affected: 0.31.12
Unaffected: 0.31.13
    cpe:2.3:h:harnessrouter:harnessrouter:*:*:*:*:*:*:*:*
Credits
mikannse (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:h:harnessrouter:harnessrouter:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Targets Test Endpoint"
          ],
          "product": "HarnessRouter",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "0.31.0"
            },
            {
              "status": "affected",
              "version": "0.31.1"
            },
            {
              "status": "affected",
              "version": "0.31.2"
            },
            {
              "status": "affected",
              "version": "0.31.3"
            },
            {
              "status": "affected",
              "version": "0.31.4"
            },
            {
              "status": "affected",
              "version": "0.31.5"
            },
            {
              "status": "affected",
              "version": "0.31.6"
            },
            {
              "status": "affected",
              "version": "0.31.7"
            },
            {
              "status": "affected",
              "version": "0.31.8"
            },
            {
              "status": "affected",
              "version": "0.31.9"
            },
            {
              "status": "affected",
              "version": "0.31.10"
            },
            {
              "status": "affected",
              "version": "0.31.11"
            },
            {
              "status": "affected",
              "version": "0.31.12"
            },
            {
              "status": "unaffected",
              "version": "0.31.13"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "mikannse (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T19:15:12.924Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-424709 | HarnessRouter Targets Test Endpoint app.py server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/424709"
        },
        {
          "name": "VDB-424709 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/424709/cti"
        },
        {
          "name": "CVE-2026-114362 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-114362"
        },
        {
          "name": "Submit #1019387 | harnessrouter \u003e= 0.9.0, \u003c 0.31.13 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1019387"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-c5g7-c47h-f6c3"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/pull/429"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/commit/1c4b1fc1f89737dabd089ac1d1c174a57f764e28"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.13"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-21T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-21T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-21T11:06:25.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "HarnessRouter Targets Test Endpoint app.py server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-114362",
    "datePublished": "2026-10-21T19:15:12.924Z",
    "dateReserved": "2026-10-21T09:01:12.834Z",
    "dateUpdated": "2026-10-21T19:15:12.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list