Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
3206 vulnerabilities reference this CWE, most recent first.
CVE-2026-112337 (GCVE-0-2026-112337)
Vulnerability from cvelistv5 – Published: 2026-11-06 15:00 – Updated: 2026-11-09 22:46
VLAI
EPSS
VEX
Title
Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination
Summary
Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 22:34 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/wazuh/wazuh/security/advisorie… | vendor-advisory |
| https://github.com/wazuh/wazuh/releases/tag/v4.14.9 | release-notes |
| https://www.vulncheck.com/advisories/wazuh-3.7.0-… | third-party-advisory |
Impacted products
Date Public
2026-11-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T22:34:32.070765Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T22:46:07.138Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/wazuh/wazuh",
"product": "wazuh",
"vendor": "wazuh",
"versions": [
{
"lessThan": "4.14.9",
"status": "affected",
"version": "3.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.14.9",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.9",
"versionStartIncluding": "3.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.9",
"versionStartIncluding": "3.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ShivarajRN"
},
{
"lang": "en",
"type": "remediation developer",
"value": "vikman90"
}
],
"datePublic": "2026-11-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:00:44.530Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qxg8-jrjm-w96h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-qxg8-jrjm-w96h"
},
{
"name": "wazuh v4.14.9 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/wazuh/wazuh/releases/tag/v4.14.9"
},
{
"name": "VulnCheck Advisory: Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wazuh-3.7.0-before-4.14.9-ssrf-via-azure-graph-nextlink-pagination"
}
],
"title": "Wazuh 3.7.0 before 4.14.9 SSRF via Azure Graph nextLink Pagination",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112337",
"datePublished": "2026-11-06T15:00:44.530Z",
"dateReserved": "2026-10-19T14:41:46.701Z",
"dateUpdated": "2026-11-09T22:46:07.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112308 (GCVE-0-2026-112308)
Vulnerability from cvelistv5 – Published: 2026-10-19 15:28 – Updated: 2026-10-19 18:23
VLAI
EPSS
VEX
Title
crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool
Summary
crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:23 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/crewAIInc/crewAI/pull/6870 | patchissue-tracking |
| https://github.com/crewAIInc/crewAI/blob/1.15.28/… | technical-description |
| https://www.vulncheck.com/advisories/crewai-tools… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| crewAIInc | crewai-tools |
Affected:
0 , ≤ 1.15.28
(semver)
cpe:2.3:a:crewai:crewai:*:*:*:*:*:*:*:* |
Date Public
2026-08-08 09:18
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112308",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T18:23:18.177311Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:23:27.612Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/crewai-tools",
"product": "crewai-tools",
"repo": "https://github.com/crewAIInc/crewAI",
"vendor": "crewAIInc",
"versions": [
{
"lessThanOrEqual": "1.15.28",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:crewai:crewai:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.15.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SashaMIT"
},
{
"lang": "en",
"type": "finder",
"value": "Zachariah Mithani"
}
],
"datePublic": "2026-08-08T09:18:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:28:57.761Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/crewAIInc/crewAI/pull/6870"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/crewAIInc/crewAI/blob/1.15.28/lib/crewai-tools/src/crewai_tools/tools/selenium_scraping_tool/selenium_scraping_tool.py"
},
{
"name": "VulnCheck Advisory: crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crewai-tools-through-1.15.28-ssrf-via-seleniumscrapingtool"
}
],
"title": "crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112308",
"datePublished": "2026-10-19T15:28:57.761Z",
"dateReserved": "2026-10-19T14:14:29.070Z",
"dateUpdated": "2026-10-19T18:23:27.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112299 (GCVE-0-2026-112299)
Vulnerability from cvelistv5 – Published: 2026-10-19 20:15 – Updated: 2026-10-20 15:04 X_Open Source
VLAI
EPSS
VEX
Title
smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery
Summary
A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 15:03 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422345 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422345/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112299 | third-party-advisory |
| https://vuldb.com/submit/986838 | third-party-advisory |
| https://github.com/smrealms/smr/pull/2579 | issue-trackingpatch |
| https://github.com/smrealms/smr/commit/cb402e7f4e… | patch |
| https://github.com/smrealms/smr/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112299",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T15:03:45.971086Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T15:04:50.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/986838"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:smrealms:smr:*:*:*:*:*:*:*:*"
],
"modules": [
"Album Website"
],
"product": "smr",
"vendor": "smrealms",
"versions": [
{
"status": "affected",
"version": "f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Plus0ne_27 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:15:27.596Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422345 | smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422345"
},
{
"name": "VDB-422345 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422345/cti"
},
{
"name": "CVE-2026-112299 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112299"
},
{
"name": "Submit #986838 | smrealms project contributors smr (Space Merchant Realms open-source game engine) commit 9f7c8a9 Server-Side Request Forgery (SSRF) \u2014 CWE-918",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/986838"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/smrealms/smr/pull/2579"
},
{
"tags": [
"patch"
],
"url": "https://github.com/smrealms/smr/commit/cb402e7f4e70b617b59d8c55dbe926b951ceb4a8"
},
{
"tags": [
"product"
],
"url": "https://github.com/smrealms/smr/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-07T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T16:04:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112299",
"datePublished": "2026-10-19T20:15:27.596Z",
"dateReserved": "2026-10-19T13:58:55.048Z",
"dateUpdated": "2026-10-20T15:04:50.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112297 (GCVE-0-2026-112297)
Vulnerability from cvelistv5 – Published: 2026-10-19 19:45 – Updated: 2026-10-22 21:03
VLAI
EPSS
VEX
Title
ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery
Summary
A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument base_url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 21:02 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
VulDB
CNA
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422342 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422342/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112297 | third-party-advisory |
| https://vuldb.com/submit/986822 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ptbsare | anx-calibre-manager |
Affected:
1.13.0
Affected: 1.13.1 Affected: 1.13.2 Affected: 1.13.3 Affected: 1.13.4 Affected: 1.13.5 Affected: 1.13.6 Affected: 1.13.7 Affected: 1.13.8 Affected: 1.13.9 Affected: 1.13.10 Affected: 1.13.11 Affected: 1.13.12 cpe:2.3:a:ptbsare:anx-calibre-manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112297",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T21:02:55.585529Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T21:03:05.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ptbsare:anx-calibre-manager:*:*:*:*:*:*:*:*"
],
"modules": [
"LLM Configuration Handler"
],
"product": "anx-calibre-manager",
"vendor": "ptbsare",
"versions": [
{
"status": "affected",
"version": "1.13.0"
},
{
"status": "affected",
"version": "1.13.1"
},
{
"status": "affected",
"version": "1.13.2"
},
{
"status": "affected",
"version": "1.13.3"
},
{
"status": "affected",
"version": "1.13.4"
},
{
"status": "affected",
"version": "1.13.5"
},
{
"status": "affected",
"version": "1.13.6"
},
{
"status": "affected",
"version": "1.13.7"
},
{
"status": "affected",
"version": "1.13.8"
},
{
"status": "affected",
"version": "1.13.9"
},
{
"status": "affected",
"version": "1.13.10"
},
{
"status": "affected",
"version": "1.13.11"
},
{
"status": "affected",
"version": "1.13.12"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Plus0ne_27 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument base_url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:45:05.618Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422342 | ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422342"
},
{
"name": "VDB-422342 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422342/cti"
},
{
"name": "CVE-2026-112297 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112297"
},
{
"name": "Submit #986822 | ptbsare (anx-calibre-manager project contributors) anx-calibre-manager (Flask web companion for the Calibre e-book manager) v1.13.12 Server-Side Request Forgery (SSRF) \u2014 CWE-918",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/986822"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T16:00:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112297",
"datePublished": "2026-10-19T19:45:05.618Z",
"dateReserved": "2026-10-19T13:55:26.019Z",
"dateUpdated": "2026-10-22T21:03:05.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112288 (GCVE-0-2026-112288)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-22 02:54
VLAI
EPSS
VEX
Title
Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
Summary
Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 02:54 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/krayin/laravel-crm/pull/2683 | patchissue-tracking |
| https://github.com/krayin/laravel-crm/commit/64b9… | patch |
| https://github.com/krayin/laravel-crm/blob/v2.2.6… | technical-description |
| https://github.com/krayin/laravel-crm/releases/ta… | release-notes |
| https://www.vulncheck.com/advisories/krayin-crm-2… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| krayin | laravel-crm |
Affected:
2.2.5 , < 2.2.7
(semver)
|
Date Public
2026-10-09 13:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112288",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T02:54:31.018474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:54:40.630Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/krayin/laravel-crm",
"product": "laravel-crm",
"repo": "https://github.com/krayin/laravel-crm",
"vendor": "krayin",
"versions": [
{
"lessThan": "2.2.7",
"status": "affected",
"version": "2.2.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adham Mohammed Abd El-Kawi"
}
],
"datePublic": "2026-10-09T13:37:12.000Z",
"descriptions": [
{
"lang": "en",
"value": "Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:31.283Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/krayin/laravel-crm/pull/2683"
},
{
"tags": [
"patch"
],
"url": "https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Automation/src/Services/WebhookService.php"
},
{
"name": "Krayin CRM v2.2.7 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/krayin/laravel-crm/releases/tag/v2.2.7"
},
{
"name": "VulnCheck Advisory: Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/krayin-crm-2.2.5-before-2.2.7-ssrf-filter-bypass-via-dns-rebinding"
}
],
"title": "Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112288",
"datePublished": "2026-10-19T13:55:31.283Z",
"dateReserved": "2026-10-19T13:25:33.179Z",
"dateUpdated": "2026-10-22T02:54:40.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112267 (GCVE-0-2026-112267)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 19:36
VLAI
EPSS
VEX
Title
SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker
Summary
SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker's /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 19:36 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/sgl-project/sglang/issues/45008 | issue-tracking |
| https://github.com/sgl-project/sglang/blob/v0.5.2… | technical-description |
| https://github.com/sgl-project/sglang/blob/v0.5.2… | technical-description |
| https://www.vulncheck.com/advisories/sglang-throu… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sgl-project | sglang |
Affected:
0 , ≤ 0.5.22
(semver)
|
Date Public
2026-10-18 14:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112267",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T19:36:21.462681Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:36:30.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/sgl-project/sglang/issues/45008"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/sglang",
"product": "sglang",
"repo": "https://github.com/sgl-project/sglang",
"vendor": "sgl-project",
"versions": [
{
"lessThanOrEqual": "0.5.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mingkai Yu"
},
{
"lang": "en",
"type": "finder",
"value": "Qiang Fu"
},
{
"lang": "en",
"type": "finder",
"value": "Jiadai Wang"
},
{
"lang": "en",
"type": "finder",
"value": "Jiajia Liu"
}
],
"datePublic": "2026-10-18T14:50:59.000Z",
"descriptions": [
{
"lang": "en",
"value": "SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port fields. Attackers sending crafted requests to the Decode worker\u0027s /generate endpoint can probe internal hosts and ports and block the shared scheduler loop, delaying other inference requests."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:16.522Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/sgl-project/sglang/issues/45008"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/common/conn.py#L1157-L1181"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/sgl-project/sglang/blob/v0.5.22/python/sglang/srt/disaggregation/decode.py#L1150-L1175"
},
{
"name": "VulnCheck Advisory: SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sglang-through-0.5.22-ssrf-via-bootstrap-host-and-bootstrap-port-on-decode-worker"
}
],
"title": "SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112267",
"datePublished": "2026-10-19T13:55:16.522Z",
"dateReserved": "2026-10-19T13:25:24.708Z",
"dateUpdated": "2026-10-19T19:36:30.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112254 (GCVE-0-2026-112254)
Vulnerability from cvelistv5 – Published: 2026-10-19 19:30 – Updated: 2026-10-19 21:20 X_Open Source
VLAI
EPSS
VEX
Title
agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery
Summary
A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function _fetch_html of the file locations/services/property_url_importer.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.17.587 addresses this issue. The patch is identified as 7e75c6cc6a07621c10be9b07fafd99e89a02e327. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 21:20 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422335 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422335/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112254 | third-party-advisory |
| https://vuldb.com/submit/986798 | third-party-advisory |
| https://github.com/agit8or1/clientst0r/commit/7e7… | patch |
| https://github.com/agit8or1/clientst0r/releases/t… | patch |
| https://github.com/agit8or1/clientst0r/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| agit8or1 | clientst0r |
Affected:
3.17.586
Unaffected: 3.17.587 cpe:2.3:a:agit8or1:clientst0r:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112254",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T21:20:31.066710Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:20:40.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:agit8or1:clientst0r:*:*:*:*:*:*:*:*"
],
"modules": [
"Property URL Importer"
],
"product": "clientst0r",
"vendor": "agit8or1",
"versions": [
{
"status": "affected",
"version": "3.17.586"
},
{
"status": "unaffected",
"version": "3.17.587"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Plus0ne_27 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function _fetch_html of the file locations/services/property_url_importer.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.17.587 addresses this issue. The patch is identified as 7e75c6cc6a07621c10be9b07fafd99e89a02e327. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T19:30:12.663Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422335 | agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422335"
},
{
"name": "VDB-422335 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422335/cti"
},
{
"name": "CVE-2026-112254 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112254"
},
{
"name": "Submit #986798 | agit8or1 clientst0r (Django + MariaDB IT documentation / MSP asset management web application; agit8or1/clientst0r on GitHub, \u260572, not ar Latest commit on main HEAD at time of audit. property_url_importer.py introduced before v1.0 and unchanged through",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/986798"
},
{
"tags": [
"patch"
],
"url": "https://github.com/agit8or1/clientst0r/commit/7e75c6cc6a07621c10be9b07fafd99e89a02e327"
},
{
"tags": [
"patch"
],
"url": "https://github.com/agit8or1/clientst0r/releases/tag/v3.17.587"
},
{
"tags": [
"product"
],
"url": "https://github.com/agit8or1/clientst0r/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T15:02:22.000Z",
"value": "VulDB entry last update"
}
],
"title": "agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112254",
"datePublished": "2026-10-19T19:30:12.663Z",
"dateReserved": "2026-10-19T12:57:17.776Z",
"dateUpdated": "2026-10-19T21:20:40.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112237 (GCVE-0-2026-112237)
Vulnerability from cvelistv5 – Published: 2026-10-20 09:30 – Updated: 2026-10-20 19:06
VLAI
EPSS
VEX
Title
Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
Summary
The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:06 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
TYPO3
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TYPO3 | Extension "Kitodo.Presentation" |
Affected:
7.0.0 , < 7.0.2
(semver)
Affected: 0 , < 6.0.1 (semver) |
Date Public
2026-10-20 09:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112237",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:06:36.414831Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:06:47.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org/",
"defaultStatus": "unaffected",
"packageName": "kitodo/presentation",
"product": "Extension \"Kitodo.Presentation\"",
"vendor": "TYPO3",
"versions": [
{
"lessThan": "7.0.2",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThan": "6.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Xanlar Agamalizade"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Sebastian Meyer"
}
],
"datePublic": "2026-10-20T09:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed."
}
],
"value": "The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bodies are not disclosed."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T09:30:52.452Z",
"orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"shortName": "TYPO3"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-032"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Server-Side Request Forgery in extension \"Kitodo.Presentation\" (dlf)",
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
"assignerShortName": "TYPO3",
"cveId": "CVE-2026-112237",
"datePublished": "2026-10-20T09:30:52.452Z",
"dateReserved": "2026-10-19T11:29:03.293Z",
"dateUpdated": "2026-10-20T19:06:47.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112076 (GCVE-0-2026-112076)
Vulnerability from cvelistv5 – Published: 2026-10-19 04:00 – Updated: 2026-10-19 17:39 X_Open Source
VLAI
EPSS
VEX
Title
alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery
Summary
A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.09.29 is able to resolve this issue. The name of the patch is a3896604540223ecbb8258b41b1d745d62647d16. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 17:38 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421755 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421755/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112076 | third-party-advisory |
| https://vuldb.com/submit/1009577 | third-party-advisory |
| https://github.com/alexta69/metube/security/advis… | exploit |
| https://github.com/alexta69/metube/commit/a389660… | patch |
| https://github.com/alexta69/metube/releases/tag/2… | patch |
| https://github.com/alexta69/metube/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| alexta69 | MeTube |
Affected:
2026.09.0
Affected: 2026.09.1 Affected: 2026.09.2 Affected: 2026.09.3 Affected: 2026.09.4 Affected: 2026.09.5 Affected: 2026.09.6 Affected: 2026.09.7 Affected: 2026.09.8 Affected: 2026.09.9 Affected: 2026.09.10 Affected: 2026.09.11 Affected: 2026.09.12 Affected: 2026.09.13 Affected: 2026.09.14 Affected: 2026.09.15 Affected: 2026.09.16 Affected: 2026.09.17 Affected: 2026.09.18 Affected: 2026.09.19 Affected: 2026.09.20 Affected: 2026.09.21 Affected: 2026.09.22 Affected: 2026.09.23 Affected: 2026.09.24 Affected: 2026.09.25 Affected: 2026.09.26 Affected: 2026.09.27 Affected: 2026.09.28 Unaffected: 2026.09.29 cpe:2.3:a:alexta69:metube:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112076",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T17:38:52.537457Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T17:39:09.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:alexta69:metube:*:*:*:*:*:*:*:*"
],
"modules": [
"Feed-metadata Thumbnail Fetch Handler"
],
"product": "MeTube",
"vendor": "alexta69",
"versions": [
{
"status": "affected",
"version": "2026.09.0"
},
{
"status": "affected",
"version": "2026.09.1"
},
{
"status": "affected",
"version": "2026.09.2"
},
{
"status": "affected",
"version": "2026.09.3"
},
{
"status": "affected",
"version": "2026.09.4"
},
{
"status": "affected",
"version": "2026.09.5"
},
{
"status": "affected",
"version": "2026.09.6"
},
{
"status": "affected",
"version": "2026.09.7"
},
{
"status": "affected",
"version": "2026.09.8"
},
{
"status": "affected",
"version": "2026.09.9"
},
{
"status": "affected",
"version": "2026.09.10"
},
{
"status": "affected",
"version": "2026.09.11"
},
{
"status": "affected",
"version": "2026.09.12"
},
{
"status": "affected",
"version": "2026.09.13"
},
{
"status": "affected",
"version": "2026.09.14"
},
{
"status": "affected",
"version": "2026.09.15"
},
{
"status": "affected",
"version": "2026.09.16"
},
{
"status": "affected",
"version": "2026.09.17"
},
{
"status": "affected",
"version": "2026.09.18"
},
{
"status": "affected",
"version": "2026.09.19"
},
{
"status": "affected",
"version": "2026.09.20"
},
{
"status": "affected",
"version": "2026.09.21"
},
{
"status": "affected",
"version": "2026.09.22"
},
{
"status": "affected",
"version": "2026.09.23"
},
{
"status": "affected",
"version": "2026.09.24"
},
{
"status": "affected",
"version": "2026.09.25"
},
{
"status": "affected",
"version": "2026.09.26"
},
{
"status": "affected",
"version": "2026.09.27"
},
{
"status": "affected",
"version": "2026.09.28"
},
{
"status": "unaffected",
"version": "2026.09.29"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lijunjie (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.09.29 is able to resolve this issue. The name of the patch is a3896604540223ecbb8258b41b1d745d62647d16. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.1,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T04:00:24.548Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421755 | alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421755"
},
{
"name": "VDB-421755 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421755/cti"
},
{
"name": "CVE-2026-112076 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112076"
},
{
"name": "Submit #1009577 | alexta69 MeTube up to 2026.09.26 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1009577"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/alexta69/metube/security/advisories/GHSA-hq22-f7w6-p8cr"
},
{
"tags": [
"patch"
],
"url": "https://github.com/alexta69/metube/commit/a3896604540223ecbb8258b41b1d745d62647d16"
},
{
"tags": [
"patch"
],
"url": "https://github.com/alexta69/metube/releases/tag/2026.09.29"
},
{
"tags": [
"product"
],
"url": "https://github.com/alexta69/metube/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T15:55:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112076",
"datePublished": "2026-10-19T04:00:24.548Z",
"dateReserved": "2026-10-18T13:50:37.441Z",
"dateUpdated": "2026-10-19T17:39:09.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111936 (GCVE-0-2026-111936)
Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-22 02:46
VLAI
EPSS
VEX
Title
Sigma File Manager through 2.2.0 SSRF via Extension Download Commands
Summary
Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 02:46 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/aleksey-hoffman/sigma-file-man… | issue-tracking |
| https://github.com/aleksey-hoffman/sigma-file-man… | patch |
| https://github.com/aleksey-hoffman/sigma-file-man… | technical-description |
| https://github.com/aleksey-hoffman/sigma-file-man… | technical-description |
| https://www.vulncheck.com/advisories/sigma-file-m… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aleksey-hoffman | Sigma File Manager |
Affected:
0 , ≤ 2.2.0
(semver)
|
Date Public
2026-10-18 00:35
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111936",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T02:46:27.586788Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:46:37.174Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sigma File Manager",
"repo": "https://github.com/aleksey-hoffman/sigma-file-manager",
"vendor": "aleksey-hoffman",
"versions": [
{
"lessThanOrEqual": "2.2.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-18T00:35:26.000Z",
"descriptions": [
{
"lang": "en",
"value": "Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T13:55:10.311Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/aleksey-hoffman/sigma-file-manager/issues/552"
},
{
"tags": [
"patch"
],
"url": "https://github.com/aleksey-hoffman/sigma-file-manager/commit/45cedf892f800c6b140b0e3cd6e55fdbcf2cf479"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/security.rs"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/aleksey-hoffman/sigma-file-manager/blob/v2.2.0/src-tauri/src/extensions/filesystem.rs"
},
{
"name": "VulnCheck Advisory: Sigma File Manager through 2.2.0 SSRF via Extension Download Commands",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/sigma-file-manager-through-2.2.0-ssrf-via-extension-download-commands"
}
],
"title": "Sigma File Manager through 2.2.0 SSRF via Extension Download Commands",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111936",
"datePublished": "2026-10-19T13:55:10.311Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-22T02:46:37.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.