Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:918"
686 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-45310 |
high | 7.4 | 0.0028 | 2026-05-28 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validat | |
CVE-2026-45373 |
high | 7.4 | 0.0030 | 2026-05-28 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated | |
CVE-2026-56676 |
high | 7.4 | 0.0019 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the | |
CVE-2026-54660 |
high | 7.4 | 0.0031 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t | |
CVE-2026-50236 |
high | 7.4 | 0.0047 | 2026-08-11 | An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supp | |
CVE-2026-50237 |
high | 7.4 | 0.0047 | 2026-08-11 | A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog | |
CVE-2026-49857 |
high | 7.4 | 0.0049 | 2026-08-13 | auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. | |
CVE-2026-70666 |
high | 7.4 | 0.0022 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_u | |
CVE-2026-35587 |
high | 7.3 | 0.0040 | 2026-04-21 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Si | |
CVE-2026-12986 |
high | 7.3 | 0.0027 | 2026-06-24 | A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, | |
CVE-2026-114730 |
high | 7.2 | 0.0031 | 2026-10-22 | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request f | |
CVE-2026-35037 |
high | 7.2 | 0.0062 | 2026-04-06 | Ech0 is an open-source, self-hosted publishing platform for personal idea sharing. Prior to 4.2.8, t | |
CVE-2026-42404 |
high | 7.2 | 0.0050 | 2026-05-01 | Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy referenc | |
CVE-2026-20035 |
high | 7.2 | 0.0030 | 2026-05-06 | A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, re | |
CVE-2026-44694 |
high | 7.2 | 0.0024 | 2026-05-08 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, a | |
CVE-2026-57348 |
high | 7.2 | 0.0027 | 2026-07-02 | Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions. | |
CVE-2026-44161 |
high | 7.2 | 0.0044 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS | |
CVE-2026-57372 |
high | 7.2 | 0.0027 | 2026-07-13 | Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-basic allows Server S | |
CVE-2026-57407 |
high | 7.2 | 0.0027 | 2026-07-13 | Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for WordPress pdf-genera | |
CVE-2026-65516 |
high | 7.2 | 0.0027 | 2026-07-23 | Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions. | |
CVE-2026-21653 |
high | 7.2 | 0.0039 | 2026-07-23 | Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server | |
CVE-2026-59552 |
high | 7.2 | 0.0027 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 | |
CVE-2026-61953 |
high | 7.2 | 0.0027 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions. | |
CVE-2026-65442 |
high | 7.2 | 0.0058 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions. | |
CVE-2026-54605 |
high | 7.2 | 0.0019 | 2026-07-28 | OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0. | |
CVE-2026-66704 |
high | 7.2 | 0.0027 | 2026-08-13 | Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions. | |
CVE-2026-32473 |
high | 7.2 | 0.0027 | 2026-08-18 | Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versio | |
CVE-2026-32553 |
high | 7.2 | 0.0027 | 2026-08-18 | Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions. | |
CVE-2026-92210 |
high | 7.2 | 0.0033 | 2026-10-21 | NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability | |
CVE-2026-57114 |
high | 7.2 | 0.0019 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's | |
CVE-2026-24269 |
high | 7.1 | 0.0014 | 2026-10-27 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request for | |
CVE-2026-65120 |
high | 7.1 | 0.0014 | 2026-10-27 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request for | |
CVE-2026-40160 |
high | 7.1 | 0.0046 | 2026-04-10 | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path pas | |
CVE-2026-34476 |
high | 7.1 | 0.0048 | 2026-04-13 | Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP. This issue af | |
CVE-2026-41272 |
high | 7.1 | 0.0026 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-42261 |
high | 7.1 | 0.0024 | 2026-05-08 | PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to | |
CVE-2026-57303 |
high | 7.1 | 0.0036 | 2026-06-24 | Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external en | |
CVE-2026-59867 |
high | 7.1 | 0.0239 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved Ope | |
CVE-2026-9081 |
high | 7.1 | 0.0031 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forge | |
CVE-2026-15570 |
high | 7.1 | 0.0026 | 2026-08-07 | An improper restriction of URL schemes and destinations in the SmartCenter browserseturl command in | |
CVE-2026-75844 |
high | 7.1 | 0.0032 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DA | |
CVE-2026-76164 |
high | 7.1 | 0.0040 | 2026-08-19 | AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission | |
CVE-2026-54491 |
high | 7.1 | 0.0038 | 2026-08-19 | Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fet | |
CVE-2026-110220 |
high | 7.1 | 0.0035 | 2026-10-13 | Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that all | |
CVE-2026-35572 |
high | 7.0 | 0.0030 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 6.5.3, it is possible to trigger serv | |
CVE-2026-116066 |
high | 7.0 | 0.0028 | 2026-10-25 | Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright ser | |
CVE-2026-117565 |
medium | 6.9 | 0.0039 | 2026-10-27 | Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allo | |
CVE-2026-118679 |
medium | 6.9 | 0.0027 | 2026-10-28 | n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the | |
CVE-2026-118586 |
medium | 6.9 | 0.0031 | 2026-10-29 | A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function | |
CVE-2025-34282 |
medium | 6.9 | 0.0182 | 2025-10-17 | ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashb |