Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.1ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.EPSS 0.5%Oct 13, 2026
- High7.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.EPSS 0.6%Oct 13, 2026
- High8.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.EPSS 0.7%Oct 13, 2026
- High7.7ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.EPSS 0.7%Oct 13, 2026
- Critical10.0ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.EPSS 0.7%Oct 13, 2026
- Low3.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain condition…EPSS 0.2%Oct 13, 2026
- Critical10.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.EPSS 0.3%Oct 13, 2026
- Medium6.4A flaw was found in Quay.EPSS 0.2%Oct 12, 2026
- Medium5.3LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs…Oct 12, 2026
- Medium6.9Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecti…EPSS 0.2%Oct 11, 2026
- Medium5.3LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callb…EPSS 0.3%Oct 11, 2026
- Low2.3Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity…EPSS 0.2%Oct 10, 2026
- Medium5.3FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redire…EPSS 0.3%Oct 8, 2026
- Medium4.9IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request…EPSS 0.1%Oct 8, 2026
- Medium6.5In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from…EPSS 0.3%Oct 7, 2026
- Medium4.3Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated…Oct 6, 2026
- Medium6.3Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0EPSS 0.3%Oct 5, 2026
- Medium4.1Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API.EPSS 0.4%Sep 3, 2026
- Critical10.0SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityKEVEPSS 8.0%Sep 1, 2026
- High7.7A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends.EPSS 0.6%Aug 24, 2026
- High8.2RansomLook contains insufficient resource validation in the analysis PDF generation functionality.EPSS 0.4%Aug 24, 2026
- High7.5fast-uri is a URI parser for Node.js.EPSS 0.2%Aug 24, 2026
- High7.5fast-uri is a URI parser for Node.js.EPSS 0.2%Aug 24, 2026
- Medium6.9BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject the RFC…EPSS 0.4%Aug 24, 2026
- Medium6.9NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py.EPSS 0.3%Aug 22, 2026