Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:918"
686 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-72566 |
high | 7.7 | 0.0035 | 2026-08-10 | A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a lo | |
CVE-2026-72591 |
high | 7.7 | 0.0037 | 2026-08-10 | A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenti | |
CVE-2026-71303 |
high | 7.7 | 0.0028 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_H | |
CVE-2026-54493 |
high | 7.7 | 0.0042 | 2026-08-19 | Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible create | |
CVE-2026-77646 |
high | 7.7 | 0.0044 | 2026-08-20 | A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PT | |
CVE-2026-75888 |
high | 7.7 | 0.0038 | 2026-10-12 | A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side R | |
CVE-2026-92203 |
high | 7.7 | 0.0041 | 2026-10-21 | Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclo | |
CVE-2026-92204 |
high | 7.7 | 0.0041 | 2026-10-21 | Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosu | |
CVE-2026-45012 |
high | 7.6 | 0.0024 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29 | |
CVE-2026-18381 |
high | 7.6 | 0.0038 | 2026-07-30 | A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMe | |
CVE-2026-69257 |
high | 7.6 | 0.0043 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-73264 |
high | 7.6 | 0.0043 | 2026-08-12 | Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provide | |
CVE-2026-45741 |
high | 7.5 | 0.0037 | 2026-08-19 | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP fun | |
CVE-2026-113728 |
high | 7.5 | 0.0051 | 2026-10-20 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauth | |
CVE-2026-118659 |
high | 7.5 | 0.0039 | 2026-10-28 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prio | |
CVE-2026-70202 |
high | 7.5 | 0.0057 | 2026-10-13 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to e | |
CVE-2026-88206 |
high | 7.5 | 0.0057 | 2026-10-13 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to e | |
CVE-2026-70251 |
high | 7.5 | 0.0062 | 2026-10-13 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to e | |
CVE-2026-35036 |
high | 7.5 | 0.0033 | 2026-04-06 | Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, E | |
CVE-2026-35486 |
high | 7.5 | 0.0040 | 2026-04-07 | text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4. | |
CVE-2026-33626 |
high | 7.5 | 0.4525 | 2026-04-20 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior | |
CVE-2026-32210 |
high | 7.5 | 0.0058 | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacke | |
CVE-2026-6514 |
high | 7.5 | 0.0027 | 2026-05-14 | The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, | |
CVE-2026-54299 |
high | 7.5 | 0.0033 | 2026-06-22 | Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 | |
CVE-2026-53754 |
high | 7.5 | 0.0043 | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server | |
CVE-2026-53755 |
high | 7.5 | 0.0158 | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server | |
CVE-2026-55113 |
high | 7.5 | 0.0037 | 2026-07-02 | A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vuln | |
CVE-2026-46726 |
high | 7.5 | 0.0086 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R | |
CVE-2026-50151 |
high | 7.5 | 0.0038 | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in | |
CVE-2026-64799 |
high | 7.5 | 0.0043 | 2026-07-23 | Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users | |
CVE-2026-55391 |
high | 7.5 | 0.0031 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr | |
CVE-2026-47613 |
high | 7.5 | 0.0056 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause improper limitation of | |
CVE-2026-47614 |
high | 7.5 | 0.0056 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request for | |
CVE-2026-47615 |
high | 7.5 | 0.0056 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request for | |
CVE-2026-47616 |
high | 7.5 | 0.0056 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker m | |
CVE-2026-47617 |
high | 7.5 | 0.0056 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal media fetcher where an attacker m | |
CVE-2026-47618 |
high | 7.5 | 0.0056 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the Rust multimodal media fetcher where an attac | |
CVE-2026-66901 |
high | 7.5 | 0.0052 | 2026-08-04 | Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltra | |
CVE-2026-55524 |
high | 7.5 | 0.0024 | 2026-08-05 | PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs it | |
CVE-2026-72552 |
high | 7.5 | 0.0061 | 2026-08-11 | A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote at | |
CVE-2026-72606 |
high | 7.5 | 0.0048 | 2026-08-11 | A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote at | |
CVE-2026-59765 |
high | 7.5 | 0.0037 | 2026-08-13 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | |
CVE-2026-66304 |
high | 7.5 | 0.0097 | 2026-09-08 | Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose | |
CVE-2026-85917 |
high | 7.5 | 0.0097 | 2026-09-17 | Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate pr | |
CVE-2026-111418 |
high | 7.5 | 0.0043 | 2026-10-29 | A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PD | |
CVE-2026-57993 |
high | 7.4 | 0.0088 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
CVE-2026-58612 |
high | 7.4 | 0.0087 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to d | |
CVE-2026-34076 |
high | 7.4 | 0.0032 | 2026-04-01 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from | |
CVE-2026-39418 |
high | 7.4 | 0.0020 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network pr | |
CVE-2026-34647 |
high | 7.4 | 0.0065 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier |