Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:918"
685 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-116827 |
high | 8.2 | 0.0034 | 2026-10-27 | YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import co | |
CVE-2026-40168 |
high | 8.2 | 0.0037 | 2026-04-10 | Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vu | |
CVE-2026-42353 |
high | 8.2 | 0.0039 | 2026-05-08 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fasti | |
CVE-2026-42260 |
high | 8.2 | 0.0026 | 2026-05-12 | Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content | |
CVE-2026-43993 |
high | 8.2 | 0.0023 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge | |
CVE-2026-43929 |
high | 8.2 | 0.0027 | 2026-05-12 | ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlie | |
CVE-2026-44971 |
high | 8.2 | 0.0024 | 2026-05-27 | GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic re | |
CVE-2026-48764 |
high | 8.2 | 0.0033 | 2026-06-18 | TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented by re | |
CVE-2026-10564 |
high | 8.2 | 0.0036 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSRe | |
CVE-2026-14336 |
high | 8.2 | 0.0032 | 2026-07-02 | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' | |
CVE-2026-55641 |
high | 8.2 | 0.0033 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy re | |
CVE-2026-43910 |
high | 8.2 | 0.0043 | 2026-07-28 | Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C Web | |
CVE-2026-54690 |
high | 8.2 | 0.0039 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr | |
CVE-2026-54691 |
high | 8.2 | 0.0026 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61 | |
CVE-2026-47719 |
high | 8.2 | 0.0059 | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE | |
CVE-2026-41105 |
high | 8.1 | 0.0083 | 2026-05-07 | Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to el | |
CVE-2026-49213 |
high | 8.1 | 0.0040 | 2026-07-10 | TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/ | |
CVE-2026-62418 |
high | 8.1 | 0.0047 | 2026-07-20 | Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via | |
CVE-2026-50143 |
high | 8.1 | 0.0049 | 2026-08-18 | The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, craw | |
CVE-2026-14540 |
high | 8.0 | 0.0013 | 2026-07-31 | A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool compon | |
CVE-2026-8034 |
high | 7.9 | 0.0052 | 2026-05-07 | A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server no | |
CVE-2026-40516 |
high | 7.8 | 0.0018 | 2026-04-17 | OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fe | |
CVE-2026-24242 |
high | 7.8 | 0.0019 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side | |
CVE-2026-88967 |
high | 7.7 | 0.0029 | 2026-10-28 | A user with query access to an Azure Monitor data source in Grafana can cause server-side requests t | |
CVE-2026-13451 |
high | 7.7 | 0.0021 | 2026-10-28 | A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceServi | |
CVE-2026-69855 |
high | 7.7 | 0.0084 | 2026-08-20 | Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to di | |
CVE-2026-108456 |
high | 7.7 | 0.0070 | 2026-10-22 | Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate priv | |
CVE-2026-31945 |
high | 7.7 | 0.0026 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerab | |
CVE-2026-34746 |
high | 7.7 | 0.0031 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.79.1, an au | |
CVE-2026-39843 |
high | 7.7 | 0.0025 | 2026-04-09 | Plane is an an open-source project management tool. From 0.28.0 to before 1.3.0, the remediation of | |
CVE-2026-40348 |
high | 7.7 | 0.0038 | 2026-04-18 | Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, | |
CVE-2026-41688 |
high | 7.7 | 0.0023 | 2026-05-07 | Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, | |
CVE-2026-44335 |
high | 7.7 | 0.0038 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonA | |
CVE-2026-43884 |
high | 7.7 | 0.0035 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (p | |
CVE-2026-42141 |
high | 7.7 | 0.0037 | 2026-05-12 | Xibo is an open source digital signage platform with a web content management system and Windows dis | |
CVE-2026-47170 |
high | 7.7 | 0.0021 | 2026-06-11 | Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-ho | |
CVE-2026-46717 |
high | 7.7 | 0.0034 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-47684 |
high | 7.7 | 0.0022 | 2026-06-16 | Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and synci | |
CVE-2026-56285 |
high | 7.7 | 0.0046 | 2026-06-29 | Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and use | |
CVE-2026-54607 |
high | 7.7 | 0.0037 | 2026-07-07 | FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI s | |
CVE-2026-60105 |
high | 7.7 | 0.0151 | 2026-07-08 | Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile | |
CVE-2026-33655 |
high | 7.7 | 0.0044 | 2026-07-09 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys | |
CVE-2026-62242 |
high | 7.7 | 0.0037 | 2026-07-13 | Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allo | |
CVE-2026-63088 |
high | 7.7 | 0.0047 | 2026-07-16 | stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unau | |
CVE-2026-63764 |
high | 7.7 | 0.0051 | 2026-07-21 | LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vuln | |
CVE-2026-59931 |
high | 7.7 | 0.0047 | 2026-07-28 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 th | |
CVE-2026-67346 |
high | 7.7 | 0.0051 | 2026-07-30 | Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability | |
CVE-2026-69192 |
high | 7.7 | 0.0046 | 2026-08-03 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to | |
CVE-2026-55523 |
high | 7.7 | 0.0047 | 2026-08-05 | PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.too | |
CVE-2026-54204 |
high | 7.7 | 0.0057 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter |