Search Vulnerabilities

Flowise - Server-Side Request Forgery via Execute Flow Base URL

n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint

Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints

phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access

Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeReques...

@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config

Angular: SSRF via Hostname Hijacking in @angular/platform-server

Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass

IBM Watson Speech Services Cartridge is vulnerable to Server-Side Request Forgery (SSRF) in Sterling File Gateway

IBM WebSphere Application Server is affected by server-side request forgery

activepieces File URL file.ts handleUrlFile server-side request forgery

BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery

BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery

AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter

Capgo - Server-Side Request Forgery via Webhook URL Validation

Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)

Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option

Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping

Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter