Browse CVEs

HIGH 7.5 CVE-2026-55229 Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.34.0, Gotenberg's /forms/libreoffice/convert endpoint allows a specially crafte… Patch available Fix from $1,9502026-07-10 HIGH 7.4 CVE-2026-53450 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, coturn rejects loopback peers by default unless allow-loopback-… Coturn 4.13.0+ Fix from $1,9502026-07-10 HIGH 8.2 CVE-2026-55641 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled H… Patch available Fix from $1,9502026-07-10 HIGH 7.4 CVE-2026-56676 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/co… Patch available Fix from $1,9502026-07-10 CRITICAL 9.3 CVE-2026-15143 A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Sc… Mitigation only Fix from $2,3002026-07-10 HIGH 7.2 CVE-2026-60091 PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url … Mitigation only Fix from $1,9502026-07-10 HIGH 7.5 CVE-2026-56261 Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which… Crawl4ai 0.8.7+ Fix from $1,9502026-07-10 CRITICAL 9.3 CVE-2026-15378 A flaw was found in the `guardrails-detectors` component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery … Mitigation only Fix from $2,3002026-07-10 MEDIUM 6.4 CVE-2026-12123 The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'v… Mitigation only Fix from $1,6002026-07-10 HIGH 7.3 CVE-2026-15330 A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agen… Patch available Fix from $1,9502026-07-10 MEDIUM 6.3 CVE-2026-15317 A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file p… Mitigation only Fix from $1,6002026-07-10 HIGH 7.7 CVE-2026-33655 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF pr… New Api 0.12.0+ Fix from $1,9502026-07-09 HIGH 7.7 CVE-2026-59221 Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_… Open Webui Patch available Fix from $1,9502026-07-09 MEDIUM 6.3 CVE-2026-15189 A security vulnerability has been detected in aerostackdev aerostack-mcp up to 6315dfde7df0a15aaf743f88d91347115e09ba23. Affected by this issue is th… Mitigation only Fix from $1,6002026-07-09 HIGH 7.2 CVE-2026-44161 Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd … Fluentd 1.19.3+ Fix from $1,9502026-07-08 HIGH 8.6 CVE-2026-60105 Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist chec… Mitigation only Fix from $1,9502026-07-08 HIGH 7.4 CVE-2026-59806 Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URL… Patch available Fix from $1,9502026-07-08 MEDIUM 5.9 CVE-2026-58501 Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid_external is defined but not enforced when parsing WSDL or XSD documents, allow… Zeep 4.3.3+ Fix from $1,6002026-07-08 CRITICAL 9.3 CVE-2026-59702 repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary o… Patch available Fix from $2,3002026-07-08 HIGH 7.7 CVE-2026-54607 FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI schema importer validates only the top-level URL b… Patch available Fix from $1,9502026-07-07 MEDIUM 6.5 CVE-2026-45796 Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, an… Coder 2.24.5 / 2.29.13+ Fix from $1,6002026-07-07 HIGH 8.6 CVE-2026-59707 LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbit… Patch available Fix from $1,9502026-07-07 MEDIUM 5.5 CVE-2026-58468 NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to… Patch available Fix from $1,6002026-07-07 HIGH 8.6 CVE-2026-57573 Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-… Crawl4ai 0.9.0+ Fix from $1,9502026-07-06 MEDIUM 6.8 CVE-2026-58404 Hugo is a static site generator. From v0.162.0 through v0.163.0, the default security.http.urls policy denies requests to loopback, internal, and clo… Hugo 0.163.1+ Fix from $1,6002026-07-06 MEDIUM 5.8 CVE-2026-50134 Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.http.urls on the URL it is called with, but it did … Hugo 0.162.0+ Fix from $1,6002026-07-06 CRITICAL 9.1 CVE-2025-53830 Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud. Versions of Anti-Virus for … Mitigation only Fix from $2,3002026-07-06 HIGH 8.5 CVE-2025-53828 SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In S… Mitigation only Fix from $1,9502026-07-06 MEDIUM 5.0 CVE-2026-44936 Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 b… Rancher Fleet 0.12.15 / 0.13.11+ Fix from $1,6002026-07-06 HIGH 8.2 CVE-2026-44937 Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before … Rancher Fleet 0.12.15 / 0.13.11+ Fix from $1,9502026-07-06