CWE-918

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lac

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers t

OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect

OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() functio

Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to b

OpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a S

Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames t

Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows rem

Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy co

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.ws

Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofin

Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to re

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetchin

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by d

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resol

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace t

Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implem

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects

Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab.,

Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections. However, the proxy is

OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, Cron webhook delivery in src/gateway/server-cron.t

A vulnerability has been found in erzhongxmu JEEWMS 3.7. Affected by this issue is some unknown functionality of the fil

A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the

A vulnerability was found in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function update_sql/run_s

A vulnerability was determined in trueleaf ApiFlow 0.9.7. The impacted element is the function validateUrlSecurity of th

A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c

A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/

A vulnerability was identified in elecV2 elecV2P up to 3.8.3. This affects the function eAxios of the file /mock of the

Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in

A vulnerability was determined in huimeicloud hm_editor up to 2.2.3. Impacted is the function client.get of the file src

A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of th

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the compone

A weakness has been identified in atototo api-lab-mcp up to 0.2.1. This affects the function analyze_api_spec/generate_t

A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the function _parse_url/

A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function _get_bytes_from_web

A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the function _process_a

A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2. Affected by this vulnerability is the func

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the

A vulnerability has been found in BidingCC BuildingAI up to 26.0.1. Impacted is the function uploadRemoteFile of the fil

A vulnerability was determined in ShadowCloneLabs GlutamateMCPServers up to e2de73280b01e5d943593dd1aa2c01c5b9112f78. Af

A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b49