Common Weakness Enumeration
CWE-918
AllowedServer-Side Request Forgery (SSRF)
Abstraction: Base · Status: Incomplete
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
6521 vulnerabilities reference this CWE, most recent first.
CVE-2026-91750 (GCVE-0-2026-91750)
Vulnerability from cvelistv5 – Published: 2026-09-15 00:35 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects
Summary
WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 16:54 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Tencent/WeKnora/issues/2511 | issue-tracking |
| https://github.com/Tencent/WeKnora | product |
| https://github.com/Tencent/WeKnora/commit/1d322c5… | patch |
| https://github.com/Tencent/WeKnora/blob/v0.6.2/in… | technical-description |
| https://www.vulncheck.com/advisories/weknora-befo… | third-party-advisory |
Impacted products
Date Public
2026-09-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91750",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T16:54:08.362553Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T16:54:39.549Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Tencent/WeKnora/issues/2511"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/Tencent/WeKnora",
"product": "WeKnora",
"vendor": "Tencent",
"versions": [
{
"lessThan": "0.7.0",
"status": "affected",
"version": "0.5.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tencent:weknora:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.7.0",
"versionStartIncluding": "0.5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal network addresses, allowing access to internal services and cloud metadata."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:20.148Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2511",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Tencent/WeKnora/issues/2511"
},
{
"tags": [
"product"
],
"url": "https://github.com/Tencent/WeKnora"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Tencent/WeKnora/commit/1d322c525a6197d24f07555b4b18ad33313b4328"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Tencent/WeKnora/blob/v0.6.2/internal/application/service/knowledge_util.go#L339-L348"
},
{
"name": "VulnCheck Advisory: WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/weknora-before-0.7.0-ssrf-via-unvalidated-http-redirects"
}
],
"title": "WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91750",
"datePublished": "2026-09-15T00:35:42.122Z",
"dateReserved": "2026-09-14T23:08:34.530Z",
"dateUpdated": "2026-09-24T14:22:20.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91199 (GCVE-0-2026-91199)
Vulnerability from cvelistv5 – Published: 2026-09-14 22:10 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint
Summary
Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-local addresses including cloud metadata services to read page titles and descriptions of internal resources.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:29 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/refly-ai/refly/issues/2280 | issue-tracking |
| https://github.com/refly-ai/refly | product |
| https://github.com/refly-ai/refly/blob/77fb0ca184… | technical-description |
| https://github.com/refly-ai/refly/blob/77fb0ca184… | technical-description |
| https://www.vulncheck.com/advisories/refly-throug… | third-party-advisory |
Date Public
2026-06-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91199",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:29:07.524310Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:29:50.357Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "refly",
"vendor": "refly-ai",
"versions": [
{
"lessThanOrEqual": "1.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-local addresses including cloud metadata services to read page titles and descriptions of internal resources."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:16.169Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2280",
"tags": [
"issue-tracking"
],
"url": "https://github.com/refly-ai/refly/issues/2280"
},
{
"tags": [
"product"
],
"url": "https://github.com/refly-ai/refly"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/refly-ai/refly/blob/77fb0ca184251bba7380cbac2dbdf7a6c9944652/packages/utils/src/scrape-weblink.ts"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/refly-ai/refly/blob/77fb0ca184251bba7380cbac2dbdf7a6c9944652/apps/api/src/modules/misc/misc.controller.ts#L38-L43"
},
{
"name": "VulnCheck Advisory: Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/refly-through-1.1.0-server-side-request-forgery-via-scrape-endpoint"
}
],
"title": "Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91199",
"datePublished": "2026-09-14T22:10:56.493Z",
"dateReserved": "2026-09-14T21:55:43.349Z",
"dateUpdated": "2026-09-24T14:22:16.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91129 (GCVE-0-2026-91129)
Vulnerability from cvelistv5 – Published: 2026-09-22 19:05 – Updated: 2026-09-24 15:25
VLAI
EPSS
VEX
Title
Home Assistant: mDNS Server-Side Request Forgery
Summary
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 15:24 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/home-assistant/core/security/a… | x_refsource_CONFIRM |
| https://github.com/home-assistant/core/pull/162941 | x_refsource_MISC |
| https://github.com/home-assistant/core/commit/0f3… | x_refsource_MISC |
| https://github.com/home-assistant/core/commit/815… | x_refsource_MISC |
| https://github.com/home-assistant/core/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| home-assistant | core |
Affected:
< 2026.2.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91129",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T15:24:54.228110Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T15:25:00.416Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "home-assistant",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.2.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path values to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect the request to 127.0.0.1 or another internal service without user interaction or prior IPP configuration. This issue is fixed in version 2026.2.3."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T19:05:15.559Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/home-assistant/core/security/advisories/GHSA-4ghv-53cq-7wp3"
},
{
"name": "https://github.com/home-assistant/core/pull/162941",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/home-assistant/core/pull/162941"
},
{
"name": "https://github.com/home-assistant/core/commit/0f3c7ca2772b605c0f3c09c88f35e527ea6ea560",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/home-assistant/core/commit/0f3c7ca2772b605c0f3c09c88f35e527ea6ea560"
},
{
"name": "https://github.com/home-assistant/core/commit/815c708d19aa0c7f59f9ee318b613a5e481a42b3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/home-assistant/core/commit/815c708d19aa0c7f59f9ee318b613a5e481a42b3"
},
{
"name": "https://github.com/home-assistant/core/releases/tag/2026.2.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/home-assistant/core/releases/tag/2026.2.3"
}
],
"source": {
"advisory": "GHSA-4ghv-53cq-7wp3",
"discovery": "UNKNOWN"
},
"title": "Home Assistant: mDNS Server-Side Request Forgery"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91129",
"datePublished": "2026-09-22T19:05:15.559Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-24T15:25:00.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91081 (GCVE-0-2026-91081)
Vulnerability from cvelistv5 – Published: 2026-09-14 17:52 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint
Summary
Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-20 00:13 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/suitenumerique/docs/issues/2545 | issue-tracking |
| https://github.com/suitenumerique/docs | product |
| https://github.com/suitenumerique/docs/blob/v5.6.… | technical-description |
| https://github.com/suitenumerique/docs/blob/v5.6.… | technical-description |
| https://www.vulncheck.com/advisories/docs-through… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| suitenumerique | docs |
Affected:
0 , ≤ 5.6.1
(semver)
|
Date Public
2026-07-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91081",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-20T00:13:42.673520Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T00:35:30.845Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "docs",
"repo": "https://github.com/suitenumerique/docs",
"vendor": "suitenumerique",
"versions": [
{
"lessThanOrEqual": "5.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses to access internal network resources and exfiltrate image content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:09.421Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #2545",
"tags": [
"issue-tracking"
],
"url": "https://github.com/suitenumerique/docs/issues/2545"
},
{
"tags": [
"product"
],
"url": "https://github.com/suitenumerique/docs"
},
{
"name": "core/api/viewsets.py at v5.6.1",
"tags": [
"technical-description"
],
"url": "https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/api/viewsets.py"
},
{
"name": "core/models.py at v5.6.1",
"tags": [
"technical-description"
],
"url": "https://github.com/suitenumerique/docs/blob/v5.6.1/src/backend/core/models.py"
},
{
"name": "VulnCheck Advisory: Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/docs-through-5.6.1-ssrf-via-unauthenticated-cors-proxy-endpoint"
}
],
"title": "Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91081",
"datePublished": "2026-09-14T17:52:08.910Z",
"dateReserved": "2026-09-14T17:33:17.464Z",
"dateUpdated": "2026-09-24T14:22:09.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91079 (GCVE-0-2026-91079)
Vulnerability from cvelistv5 – Published: 2026-09-14 17:52 – Updated: 2026-09-24 14:22
VLAI
EPSS
VEX
Title
Huly Platform through 0.7.426 SSRF via Print Service
Summary
Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:20 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/hcengineering/platform/issues/10908 | issue-tracking |
| https://github.com/hcengineering/platform | product |
| https://github.com/hcengineering/platform/blob/v0… | technical-description |
| https://github.com/hcengineering/platform/blob/v0… | technical-description |
| https://www.vulncheck.com/advisories/huly-platfor… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hcengineering | platform |
Affected:
0 , ≤ 0.7.426
(custom)
|
Date Public
2026-06-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91079",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:20:46.593809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:05:45.679Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "platform",
"repo": "https://github.com/hcengineering/platform",
"vendor": "hcengineering",
"versions": [
{
"lessThanOrEqual": "0.7.426",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images, enabling access to internal metadata services and network hosts."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:22:07.519Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #10908",
"tags": [
"issue-tracking"
],
"url": "https://github.com/hcengineering/platform/issues/10908"
},
{
"tags": [
"product"
],
"url": "https://github.com/hcengineering/platform"
},
{
"name": "pod-print server.ts at v0.7.426",
"tags": [
"technical-description"
],
"url": "https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/server.ts"
},
{
"name": "pod-print config.ts at v0.7.426",
"tags": [
"technical-description"
],
"url": "https://github.com/hcengineering/platform/blob/v0.7.426/services/print/pod-print/src/config.ts"
},
{
"name": "VulnCheck Advisory: Huly Platform through 0.7.426 SSRF via Print Service",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/huly-platform-through-0.7.426-ssrf-via-print-service"
}
],
"title": "Huly Platform through 0.7.426 SSRF via Print Service",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-91079",
"datePublished": "2026-09-14T17:52:07.537Z",
"dateReserved": "2026-09-14T17:33:07.606Z",
"dateUpdated": "2026-09-24T14:22:07.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90818 (GCVE-0-2026-90818)
Vulnerability from cvelistv5 – Published: 2026-09-14 20:15 – Updated: 2026-09-16 16:20
VLAI
EPSS
VEX
Title
netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery
Summary
A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 16:20 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403321 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403321/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90818 | third-party-advisory |
| https://vuldb.com/submit/922881 | third-party-advisory |
| https://github.com/netease-youdao/LobsterAI/issues/2181 | issue-tracking |
| https://gist.github.com/YLChen-007/e5f88777e7c505… | exploit |
| https://github.com/netease-youdao/LobsterAI/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| netease-youdao | LobsterAI |
Affected:
2026.6.15
Affected: 2026.8.28 Affected: 2026.9.3 Affected: 2026.9.4 cpe:2.3:a:netease-youdao:lobsterai:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90818",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T16:20:06.645523Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T16:20:17.358Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:netease-youdao:lobsterai:*:*:*:*:*:*:*:*"
],
"modules": [
"Browser Network Configuration"
],
"product": "LobsterAI",
"vendor": "netease-youdao",
"versions": [
{
"status": "affected",
"version": "2026.6.15"
},
{
"status": "affected",
"version": "2026.8.28"
},
{
"status": "affected",
"version": "2026.9.3"
},
{
"status": "affected",
"version": "2026.9.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-a (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The reported GitHub issue was closed automatically due to inactivity."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:15:12.110Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403321 | netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403321"
},
{
"name": "VDB-403321 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403321/cti"
},
{
"name": "CVE-2026-90818 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90818"
},
{
"name": "Submit #922881 | NetEase Youdao LobsterAI (lobsterai) 2026.6.15 Server-Side Request Forgery (CWE-918)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/922881"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/netease-youdao/LobsterAI/issues/2181"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/YLChen-007/e5f88777e7c50549fd98b23b2988f78d"
},
{
"tags": [
"product"
],
"url": "https://github.com/netease-youdao/LobsterAI/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T20:53:07.000Z",
"value": "VulDB entry last update"
}
],
"title": "netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90818",
"datePublished": "2026-09-14T20:15:12.110Z",
"dateReserved": "2026-09-13T18:43:42.987Z",
"dateUpdated": "2026-09-16T16:20:17.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90814 (GCVE-0-2026-90814)
Vulnerability from cvelistv5 – Published: 2026-09-14 19:30 – Updated: 2026-09-15 13:56
VLAI
EPSS
VEX
Title
cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery
Summary
A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 13:42 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403316 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403316/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90814 | third-party-advisory |
| https://vuldb.com/submit/922880 | third-party-advisory |
| https://github.com/cosmicstack-labs/mercury-agent… | exploitissue-tracking |
| https://github.com/cosmicstack-labs/mercury-agent/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| cosmicstack-labs | mercury-agent |
Affected:
1.1.0
Affected: 1.1.1 Affected: 1.1.2 Affected: 1.1.3 Affected: 1.1.4 Affected: 1.1.5 Affected: 1.1.6 Affected: 1.1.7 Affected: 1.1.8 Affected: 1.1.9 Affected: 1.1.10 Affected: 1.1.11 Affected: 1.1.12 Affected: 1.1.13 cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90814",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T13:42:07.458903Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T13:56:09.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:*"
],
"modules": [
"GitHub API Handler"
],
"product": "mercury-agent",
"vendor": "cosmicstack-labs",
"versions": [
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "affected",
"version": "1.1.1"
},
{
"status": "affected",
"version": "1.1.2"
},
{
"status": "affected",
"version": "1.1.3"
},
{
"status": "affected",
"version": "1.1.4"
},
{
"status": "affected",
"version": "1.1.5"
},
{
"status": "affected",
"version": "1.1.6"
},
{
"status": "affected",
"version": "1.1.7"
},
{
"status": "affected",
"version": "1.1.8"
},
{
"status": "affected",
"version": "1.1.9"
},
{
"status": "affected",
"version": "1.1.10"
},
{
"status": "affected",
"version": "1.1.11"
},
{
"status": "affected",
"version": "1.1.12"
},
{
"status": "affected",
"version": "1.1.13"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-a (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T19:30:09.473Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403316 | cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403316"
},
{
"name": "VDB-403316 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403316/cti"
},
{
"name": "CVE-2026-90814 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90814"
},
{
"name": "Submit #922880 | CosmicStack Labs Mercury Agent (@cosmicstack/mercury-agent) \u003c= 1.1.13 Server-Side Request Forgery (CWE-918) / Token Exfiltration",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/922880"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/cosmicstack-labs/mercury-agent/issues/81"
},
{
"tags": [
"product"
],
"url": "https://github.com/cosmicstack-labs/mercury-agent/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T18:38:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90814",
"datePublished": "2026-09-14T19:30:09.473Z",
"dateReserved": "2026-09-13T16:29:55.084Z",
"dateUpdated": "2026-09-15T13:56:09.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90790 (GCVE-0-2026-90790)
Vulnerability from cvelistv5 – Published: 2026-09-14 14:30 – Updated: 2026-09-15 13:56
VLAI
EPSS
VEX
Title
a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery
Summary
A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender. The manipulation of the argument push_info.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 13:33 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403296 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403296/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90790 | third-party-advisory |
| https://vuldb.com/submit/919747 | third-party-advisory |
| https://github.com/a2aproject/a2a-python/pull/1164 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-python/pull/1169 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-python/releases… | patch |
| https://github.com/a2aproject/a2a-python/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-python |
Affected:
1.1.0
Affected: 1.1.1 Affected: 1.1.2 Affected: 1.1.3 Unaffected: 1.1.4 cpe:2.3:a:a2aproject:a2a-python:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90790",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T13:33:15.907930Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T13:56:53.326Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-python:*:*:*:*:*:*:*:*"
],
"modules": [
"Push Notification Sender"
],
"product": "a2a-python",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "affected",
"version": "1.1.1"
},
{
"status": "affected",
"version": "1.1.2"
},
{
"status": "affected",
"version": "1.1.3"
},
{
"status": "unaffected",
"version": "1.1.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ez-lbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/tasks/base_push_notification_sender.py of the component Push Notification Sender. The manipulation of the argument push_info.url leads to server-side request forgery. Remote exploitation of the attack is possible. Upgrading to version 1.1.4 is able to mitigate this issue. It is suggested to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T14:30:35.448Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403296 | a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403296"
},
{
"name": "VDB-403296 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403296/cti"
},
{
"name": "CVE-2026-90790 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90790"
},
{
"name": "Submit #919747 | a2aproject a2a-python v1.1.2 ssrf",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/919747"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-python/pull/1164"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-python/pull/1169"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-python/releases/tag/v1.1.4"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-python/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T15:29:55.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90790",
"datePublished": "2026-09-14T14:30:35.448Z",
"dateReserved": "2026-09-13T13:24:51.272Z",
"dateUpdated": "2026-09-15T13:56:53.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90769 (GCVE-0-2026-90769)
Vulnerability from cvelistv5 – Published: 2026-09-13 10:45 – Updated: 2026-09-24 14:21
VLAI
EPSS
VEX
Title
Open Notebook before 1.11.0 Server-Side Request Forgery via link-source
Summary
Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 15:35 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/lfnovo/open-notebook/issues/1284 | issue-tracking |
| https://github.com/lfnovo/open-notebook | product |
| https://github.com/lfnovo/open-notebook/blob/8889… | technical-description |
| https://github.com/lfnovo/open-notebook/commit/90… | patch |
| https://www.vulncheck.com/advisories/open-noteboo… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| lfnovo | open-notebook |
Affected:
0 , < 1.11.0
(semver)
cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:* |
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90769",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T15:35:56.128393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T15:36:18.070Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/lfnovo/open-notebook/issues/1284"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/lfnovo/open-notebook",
"product": "open-notebook",
"vendor": "lfnovo",
"versions": [
{
"lessThan": "1.11.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.11.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server\u0027s direct HTTP requests."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:21:50.251Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1284",
"tags": [
"issue-tracking"
],
"url": "https://github.com/lfnovo/open-notebook/issues/1284"
},
{
"tags": [
"product"
],
"url": "https://github.com/lfnovo/open-notebook"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/lfnovo/open-notebook/blob/8889087e317177d7b6e286342ab34e0c9c01d43e/api/routers/sources.py"
},
{
"tags": [
"patch"
],
"url": "https://github.com/lfnovo/open-notebook/commit/9045ea50196927eac7de647bb5b7009349236fb4"
},
{
"name": "VulnCheck Advisory: Open Notebook before 1.11.0 Server-Side Request Forgery via link-source",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-notebook-before-1.11.0-server-side-request-forgery-via-link-source"
}
],
"title": "Open Notebook before 1.11.0 Server-Side Request Forgery via link-source",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90769",
"datePublished": "2026-09-13T10:45:40.937Z",
"dateReserved": "2026-09-13T10:14:52.461Z",
"dateUpdated": "2026-09-24T14:21:50.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90710 (GCVE-0-2026-90710)
Vulnerability from cvelistv5 – Published: 2026-09-14 11:30 – Updated: 2026-09-16 14:54
VLAI
EPSS
VEX
Title
taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery
Summary
A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java of the component Theme Download Function. Executing a manipulation of the argument httpUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:54 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403265 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/403265/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90710 | third-party-advisory |
| https://vuldb.com/submit/918522 | third-party-advisory |
| https://gitee.com/taisan/tarzan-cms/issues/IK768M | exploitissue-tracking |
| https://gitee.com/taisan/tarzan-cms/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| taisan | tarzan-cms |
Affected:
1.0.0
cpe:2.3:a:taisan:tarzan-cms:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90710",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:54:26.696635Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:54:40.488Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:taisan:tarzan-cms:*:*:*:*:*:*:*:*"
],
"modules": [
"Theme Download Function"
],
"product": "tarzan-cms",
"vendor": "taisan",
"versions": [
{
"status": "affected",
"version": "1.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mjh_123 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java of the component Theme Download Function. Executing a manipulation of the argument httpUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:30:15.424Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403265 | taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/403265"
},
{
"name": "VDB-403265 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403265/cti"
},
{
"name": "CVE-2026-90710 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90710"
},
{
"name": "Submit #918522 | taisan Tarzan CMS 1.0.0 and earlier Server-Side Request Forgery (SSRF)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/918522"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://gitee.com/taisan/tarzan-cms/issues/IK768M"
},
{
"tags": [
"product"
],
"url": "https://gitee.com/taisan/tarzan-cms/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T11:17:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90710",
"datePublished": "2026-09-14T11:30:15.424Z",
"dateReserved": "2026-09-13T09:12:26.998Z",
"dateUpdated": "2026-09-16T14:54:40.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
No mitigation information available for this CWE.
CAPEC-664: Server Side Request Forgery
An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.