Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
3205 vulnerabilities reference this CWE, most recent first.
CVE-2026-119122 (GCVE-0-2026-119122)
Vulnerability from cvelistv5 – Published: 2026-10-29 15:58 – Updated: 2026-10-29 20:16
VLAI
EPSS
VEX
Title
Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
Summary
Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:15 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/unclecode/crawl4ai/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/crawl4ai-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119122",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T20:15:52.358200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:16:29.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-w4xc-px5p-c32w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:pypi/crawl4ai",
"product": "crawl4ai",
"vendor": "unclecode",
"versions": [
{
"lessThan": "0.9.5",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.9.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "arpe1618"
},
{
"lang": "en",
"type": "remediation developer",
"value": "ntohidi"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:58:05.930Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-w4xc-px5p-c32w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/unclecode/crawl4ai/security/advisories/GHSA-w4xc-px5p-c32w"
},
{
"name": "VulnCheck Advisory: Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/crawl4ai-before-0.9.5-blind-ssrf-via-cachevalidator-freshness-check"
}
],
"title": "Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119122",
"datePublished": "2026-10-29T15:58:05.930Z",
"dateReserved": "2026-10-29T14:25:14.745Z",
"dateUpdated": "2026-10-29T20:16:29.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118989 (GCVE-0-2026-118989)
Vulnerability from cvelistv5 – Published: 2026-10-29 10:57 – Updated: 2026-10-29 12:36
VLAI
EPSS
VEX
Title
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects
Summary
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 12:19 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://plugins.trac.wordpress.org/changeset/3766250/ | patch |
| https://plugins.trac.wordpress.org/browser/produc… | technical-description |
| https://plugins.trac.wordpress.org/browser/produc… | technical-description |
| https://wordpress.org/plugins/product-import-expo… | product |
| https://www.vulncheck.com/advisories/webtoffee-pr… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WebToffee | Product Import Export for WooCommerce |
Affected:
2.5.1 , < 2.6.8
(semver)
cpe:2.3:a:webtoffee:product_import_export_for_woocommerce:*:*:*:*:*:wordpress:*:* |
Date Public
2026-10-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118989",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T12:19:06.542480Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T12:36:53.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"product": "Product Import Export for WooCommerce",
"vendor": "WebToffee",
"versions": [
{
"lessThan": "2.6.8",
"status": "affected",
"version": "2.5.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webtoffee:product_import_export_for_woocommerce:*:*:*:*:*:wordpress:*:*",
"versionEndExcluding": "2.6.8",
"versionStartIncluding": "2.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Sarvar Eshboyev"
}
],
"datePublic": "2026-10-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_file that allows shop_manager users to reach internal services via redirects. Attackers can submit a .csv URL that returns an HTTP 302 redirect to an internal address, causing the server to fetch internal responses and return them as import data."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T10:57:40.767Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Changeset 3766250",
"tags": [
"patch"
],
"url": "https://plugins.trac.wordpress.org/changeset/3766250/"
},
{
"tags": [
"technical-description"
],
"url": "https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php#L563"
},
{
"tags": [
"technical-description"
],
"url": "https://plugins.trac.wordpress.org/browser/product-import-export-for-woo/tags/2.6.7/admin/modules/import/import.php#L661"
},
{
"tags": [
"product"
],
"url": "https://wordpress.org/plugins/product-import-export-for-woo/"
},
{
"name": "VulnCheck Advisory: WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/webtoffee-product-import-export-for-woocommerce-2.5.1-before-2.6.8-ssrf-via-redirects"
}
],
"title": "WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118989",
"datePublished": "2026-10-29T10:57:40.767Z",
"dateReserved": "2026-10-29T10:54:53.236Z",
"dateUpdated": "2026-10-29T12:36:53.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118766 (GCVE-0-2026-118766)
Vulnerability from cvelistv5 – Published: 2026-10-29 17:14 – Updated: 2026-11-04 01:32
VLAI
EPSS
VEX
Title
Botan: Online OCSP redirects enable blind requests to internal HTTP services
Summary
Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service. The primary impact is blind SSRF that might affect internal services with non-idempotent GET handlers, and response timing can provide a coarse internal-service oracle. This issue is fixed in version 3.13.0.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 01:32 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/randombit/botan/security/advis… | x_refsource_CONFIRM |
| https://github.com/randombit/botan/pull/5815 | x_refsource_MISC |
| https://github.com/randombit/botan/commit/9791ca3… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118766",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T01:32:43.783593Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T01:32:53.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "botan",
"vendor": "randombit",
"versions": [
{
"status": "affected",
"version": "\u003c 3.13.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Botan is a C++ cryptography library. Prior to 3.13.0, Botan\u0027s online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate\u0027s Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service. The primary impact is blind SSRF that might affect internal services with non-idempotent GET handlers, and response timing can provide a coarse internal-service oracle. This issue is fixed in version 3.13.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T17:14:47.676Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/randombit/botan/security/advisories/GHSA-9qgq-q9j4-4f82",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/randombit/botan/security/advisories/GHSA-9qgq-q9j4-4f82"
},
{
"name": "https://github.com/randombit/botan/pull/5815",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/randombit/botan/pull/5815"
},
{
"name": "https://github.com/randombit/botan/commit/9791ca39a556c76186b1fc943c7d8d460712d58f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/randombit/botan/commit/9791ca39a556c76186b1fc943c7d8d460712d58f"
}
],
"source": {
"advisory": "GHSA-9qgq-q9j4-4f82",
"discovery": "UNKNOWN"
},
"title": "Botan: Online OCSP redirects enable blind requests to internal HTTP services"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118766",
"datePublished": "2026-10-29T17:14:47.676Z",
"dateReserved": "2026-10-28T19:20:05.017Z",
"dateUpdated": "2026-11-04T01:32:53.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118679 (GCVE-0-2026-118679)
Vulnerability from cvelistv5 – Published: 2026-10-28 18:59 – Updated: 2026-11-04 20:18
VLAI
EPSS
VEX
Title
n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger
Summary
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:18 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories… | vendor-advisory |
| https://www.vulncheck.com/advisories/n8n-before-1… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118679",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:18:48.190332Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:18:55.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "1.123.83",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.123.83",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.42.1",
"status": "affected",
"version": "2.42.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.42.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"product": "n8n",
"vendor": "n8n-io",
"versions": [
{
"lessThan": "2.41.4",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.41.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.123.83",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.42.1",
"versionStartIncluding": "2.42.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.41.4",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook URL can name a file to download, causing the node to send the workspace access token to an attacker host and return the response."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:59:51.136Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3c3p-5959-3ghr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-3c3p-5959-3ghr"
},
{
"name": "VulnCheck Advisory: n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-slack-token-exfiltration-via-slack-trigger"
}
],
"title": "n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118679",
"datePublished": "2026-10-28T18:59:51.136Z",
"dateReserved": "2026-10-28T17:28:46.441Z",
"dateUpdated": "2026-11-04T20:18:55.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118660 (GCVE-0-2026-118660)
Vulnerability from cvelistv5 – Published: 2026-10-28 20:23 – Updated: 2026-10-29 17:23
VLAI
EPSS
VEX
Title
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
Summary
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0.
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 15:43 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/capricorn86/happy-dom/security… | x_refsource_CONFIRM |
| https://github.com/capricorn86/happy-dom/pull/2502 | x_refsource_MISC |
| https://github.com/capricorn86/happy-dom/commit/0… | x_refsource_MISC |
| https://github.com/capricorn86/happy-dom/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| capricorn86 | happy-dom |
Affected:
< 21.0.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118660",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T15:43:35.972529Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T17:23:32.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "happy-dom",
"vendor": "capricorn86",
"versions": [
{
"status": "affected",
"version": "\u003c 21.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel=\"stylesheet\" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T20:23:10.122Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-c8p4-j97h-3vg8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-c8p4-j97h-3vg8"
},
{
"name": "https://github.com/capricorn86/happy-dom/pull/2502",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/capricorn86/happy-dom/pull/2502"
},
{
"name": "https://github.com/capricorn86/happy-dom/commit/0a99c7525a1d0043e3182843ae33466ab7b19e74",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/capricorn86/happy-dom/commit/0a99c7525a1d0043e3182843ae33466ab7b19e74"
},
{
"name": "https://github.com/capricorn86/happy-dom/releases/tag/v21.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/capricorn86/happy-dom/releases/tag/v21.0.0"
}
],
"source": {
"advisory": "GHSA-c8p4-j97h-3vg8",
"discovery": "UNKNOWN"
},
"title": "Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118660",
"datePublished": "2026-10-28T20:23:10.122Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-29T17:23:32.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118659 (GCVE-0-2026-118659)
Vulnerability from cvelistv5 – Published: 2026-10-28 20:20 – Updated: 2026-10-29 18:27
VLAI
EPSS
VEX
Title
@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy
Summary
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 18:27 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/capricorn86/happy-dom/security… | x_refsource_CONFIRM |
| https://github.com/capricorn86/happy-dom/pull/2520 | x_refsource_MISC |
| https://github.com/capricorn86/happy-dom/commit/1… | x_refsource_MISC |
| https://github.com/capricorn86/happy-dom/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| capricorn86 | happy-dom |
Affected:
< 21.0.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118659",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T18:27:17.941408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T18:27:45.701Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "happy-dom",
"vendor": "capricorn86",
"versions": [
{
"status": "affected",
"version": "\u003c 21.0.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package\u0027s ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-controlled :path values against server.targetOrigin in #onIncomingRequest in packages/@happy-dom/server-renderer/src/ServerRendererServer.ts without confirming that the resolved origin remains trusted before calling fetch. A protocol-relative path can change the destination to an arbitrary HTTP or HTTPS endpoint reachable by the server, including local and internal services, and the proxy relays the fetched response headers and body to the requester. This issue is fixed in version 21.0.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T20:20:29.561Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/capricorn86/happy-dom/security/advisories/GHSA-pmf4-3xr3-xjhg"
},
{
"name": "https://github.com/capricorn86/happy-dom/pull/2520",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/capricorn86/happy-dom/pull/2520"
},
{
"name": "https://github.com/capricorn86/happy-dom/commit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/capricorn86/happy-dom/commit/1f3ffdf634231361de1a2acb629b4fe8ee1bd85d"
},
{
"name": "https://github.com/capricorn86/happy-dom/releases/tag/v21.0.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/capricorn86/happy-dom/releases/tag/v21.0.2"
}
],
"source": {
"advisory": "GHSA-pmf4-3xr3-xjhg",
"discovery": "UNKNOWN"
},
"title": "@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118659",
"datePublished": "2026-10-28T20:20:29.561Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-29T18:27:45.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118628 (GCVE-0-2026-118628)
Vulnerability from cvelistv5 – Published: 2026-11-03 23:46 – Updated: 2026-11-06 18:54
VLAI
EPSS
VEX
Title
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
Summary
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the get-artifacts function. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the server. Was ZDI-CAN-28192.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 18:53 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
zdi
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Date Public
2026-10-29 19:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118628",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T18:53:52.092858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:54:02.562Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "MLflow",
"vendor": "MLflow",
"versions": [
{
"status": "affected",
"version": "3.8.0"
}
]
}
],
"dateAssigned": "2026-10-28T16:57:05.610Z",
"datePublic": "2026-10-29T19:05:29.302Z",
"descriptions": [
{
"lang": "en",
"value": "MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the get-artifacts function. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the server. Was ZDI-CAN-28192."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T23:46:07.128Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-26-844",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-844/"
}
],
"source": {
"lang": "en",
"value": "Muhammad Fadilullah Dzaki"
},
"title": "MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2026-118628",
"datePublished": "2026-11-03T23:46:07.128Z",
"dateReserved": "2026-10-28T16:57:05.584Z",
"dateUpdated": "2026-11-06T18:54:02.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118586 (GCVE-0-2026-118586)
Vulnerability from cvelistv5 – Published: 2026-10-28 23:30 – Updated: 2026-11-03 13:53
VLAI
EPSS
VEX
Title
dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery
Summary
A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 13:52 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/428026 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/428026/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-118586 | third-party-advisory |
| https://vuldb.com/submit/1026092 | third-party-advisory |
| https://github.com/dfm/feedfinder2/issues/16 | issue-tracking |
| https://github.com/dfm/feedfinder2/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| dfm | feedfinder2 |
Affected:
0.0.1
Affected: 0.0.2 Affected: 0.0.3 Affected: 0.0.4 cpe:2.3:a:dfm:feedfinder2:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118586",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T13:52:16.941817Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T13:53:24.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:dfm:feedfinder2:*:*:*:*:*:*:*:*"
],
"product": "feedfinder2",
"vendor": "dfm",
"versions": [
{
"status": "affected",
"version": "0.0.1"
},
{
"status": "affected",
"version": "0.0.2"
},
{
"status": "affected",
"version": "0.0.3"
},
{
"status": "affected",
"version": "0.0.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohammedix88 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T23:30:17.619Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-428026 | dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/428026"
},
{
"name": "VDB-428026 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/428026/cti"
},
{
"name": "CVE-2026-118586 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-118586"
},
{
"name": "Submit #1026092 | dfm feedfinder2 0.0.4 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1026092"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/dfm/feedfinder2/issues/16"
},
{
"tags": [
"product"
],
"url": "https://github.com/dfm/feedfinder2/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-28T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-28T17:18:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-118586",
"datePublished": "2026-10-28T23:30:17.619Z",
"dateReserved": "2026-10-28T16:13:16.187Z",
"dateUpdated": "2026-11-03T13:53:24.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118577 (GCVE-0-2026-118577)
Vulnerability from cvelistv5 – Published: 2026-10-28 22:15 – Updated: 2026-11-03 00:11 X_Open Source
VLAI
EPSS
VEX
Title
maotoumao MusicFreeDesktop Request Forwarder server-side request forgery
Summary
A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 00:11 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
VulDB
CNA
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/428016 | vdb-entry |
| https://vuldb.com/vuln/428016/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-118577 | third-party-advisory |
| https://vuldb.com/submit/1025070 | third-party-advisory |
| https://github.com/maotoumao/MusicFreeDesktop/iss… | exploitissue-tracking |
| https://github.com/maotoumao/MusicFreeDesktop/com… | patch |
| https://github.com/maotoumao/MusicFreeDesktop/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| maotoumao | MusicFreeDesktop |
Affected:
0.0.6
Affected: 0.0.7 Affected: 0.0.8 cpe:2.3:a:maotoumao:musicfreedesktop:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118577",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T00:11:23.967553Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T00:11:37.895Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:maotoumao:musicfreedesktop:*:*:*:*:*:*:*:*"
],
"modules": [
"Request Forwarder"
],
"product": "MusicFreeDesktop",
"vendor": "maotoumao",
"versions": [
{
"status": "affected",
"version": "0.0.6"
},
{
"status": "affected",
"version": "0.0.7"
},
{
"status": "affected",
"version": "0.0.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "fifker"
},
{
"lang": "en",
"type": "finder",
"value": "notwo1f"
},
{
"lang": "en",
"type": "reporter",
"value": "wilson888 (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "wilson888 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The identifier of the patch is b0d3876247a0a64fa0e430e4b21870e41f503182. It is recommended to apply a patch to fix this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T15:52:21.877Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-428016 | maotoumao MusicFreeDesktop Request Forwarder server-side request forgery",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/428016"
},
{
"name": "VDB-428016 | CTI Indicators (IOB, IOC)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/428016/cti"
},
{
"name": "CVE-2026-118577 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-118577"
},
{
"name": "Submit #1025070 | https://github.com/maotoumao/MusicFreeDesktop MusicFreeDesktop 0.0.8 Local Sensitive Logic Exposure leading to SSRF",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1025070"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/maotoumao/MusicFreeDesktop/issues/443"
},
{
"tags": [
"patch"
],
"url": "https://github.com/maotoumao/MusicFreeDesktop/commit/b0d3876247a0a64fa0e430e4b21870e41f503182"
},
{
"tags": [
"product"
],
"url": "https://github.com/maotoumao/MusicFreeDesktop/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-28T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-29T16:54:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "maotoumao MusicFreeDesktop Request Forwarder server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-118577",
"datePublished": "2026-10-28T22:15:17.877Z",
"dateReserved": "2026-10-28T15:52:52.318Z",
"dateUpdated": "2026-11-03T00:11:37.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118376 (GCVE-0-2026-118376)
Vulnerability from cvelistv5 – Published: 2026-10-28 02:03 – Updated: 2026-10-28 16:11
VLAI
EPSS
VEX
Title
WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses
Summary
WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 14:35 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/Tencent/WeKnora/issues/4092 | issue-tracking |
| https://github.com/Tencent/WeKnora/commit/ff818b6… | patch |
| https://github.com/Tencent/WeKnora/commit/d7ccd5b… | patch |
| https://github.com/Tencent/WeKnora/blob/3d5d8bfcd… | technical-description |
| https://github.com/Tencent/WeKnora/releases/tag/v0.8.2 | release-notes |
| https://github.com/Tencent/WeKnora | product |
| https://www.vulncheck.com/advisories/weknora-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118376",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T14:35:39.639974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:11:20.194Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/Tencent/WeKnora",
"product": "WeKnora",
"repo": "https://github.com/Tencent/WeKnora",
"vendor": "Tencent",
"versions": [
{
"lessThan": "0.8.2",
"status": "affected",
"version": "0.2.11",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.8.2",
"versionStartIncluding": "0.2.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or cloud metadata endpoints."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:23.589Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/Tencent/WeKnora/issues/4092"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Tencent/WeKnora/commit/ff818b681f10bc29edbc48fe35f00009dc276bfa"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Tencent/WeKnora/commit/d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Tencent/WeKnora/blob/3d5d8bfcdfeeea266b292b71cea616847af28d0f/internal/utils/security.go#L267-L327"
},
{
"name": "WeKnora v0.8.2 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/Tencent/WeKnora/releases/tag/v0.8.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/Tencent/WeKnora"
},
{
"name": "VulnCheck Advisory: WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/weknora-before-0.8.2-ssrf-guard-bypass-via-nat64-ipv6-addresses"
}
],
"title": "WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118376",
"datePublished": "2026-10-28T02:03:23.589Z",
"dateReserved": "2026-10-28T01:19:21.768Z",
"dateUpdated": "2026-10-28T16:11:20.194Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.