CWE-918

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "webmail",
          "vendor": "bulwarkmail",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket connection. An attacker controlling authoritative DNS can return a public address during validation and then rebind the hostname to a loopback, private, link-local, or cloud metadata address for the connection, causing the server to return up to 10 MB of an internal HTTP or HTTPS response. The same check-then-fetch pattern also existed in authenticated JMAP login and TOTP token-exchange flows. This issue is fixed in version 1.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T21:12:38.182Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-24w9-8r42-8jwm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bulwarkmail/webmail/security/advisories/GHSA-24w9-8r42-8jwm"
        },
        {
          "name": "https://github.com/bulwarkmail/webmail/commit/3288589e5248dcc1da769cc578827a9ee1adc941",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bulwarkmail/webmail/commit/3288589e5248dcc1da769cc578827a9ee1adc941"
        },
        {
          "name": "https://github.com/bulwarkmail/webmail/releases/tag/1.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bulwarkmail/webmail/releases/tag/1.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-24w9-8r42-8jwm",
        "discovery": "UNKNOWN"
      },
      "title": "Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-113728",
    "datePublished": "2026-10-20T21:12:38.182Z",
    "dateReserved": "2026-10-20T16:03:14.864Z",
    "dateUpdated": "2026-10-20T21:12:38.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Push Notification Handler"
          ],
          "product": "a2a-rs",
          "vendor": "a2aproject",
          "versions": [
            {
              "status": "affected",
              "version": "0.4.0"
            },
            {
              "status": "affected",
              "version": "0.4.1"
            },
            {
              "status": "affected",
              "version": "0.4.2"
            },
            {
              "status": "affected",
              "version": "0.4.3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "colorfullbz (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T22:00:25.887Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-422865 | a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/422865"
        },
        {
          "name": "VDB-422865 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/422865/cti"
        },
        {
          "name": "CVE-2026-113704 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-113704"
        },
        {
          "name": "Submit #1014883 | a2aproject a2a-rs a2a-server-lf \u2264 0.4.3 SSRF",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1014883"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/a2aproject/a2a-rs/pull/124"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/a2aproject/a2a-rs/commit/2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/a2aproject/a2a-rs/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-20T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-20T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-20T18:02:40.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-113704",
    "datePublished": "2026-10-20T22:00:25.887Z",
    "dateReserved": "2026-10-20T15:57:11.575Z",
    "dateUpdated": "2026-10-20T22:00:25.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113671",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T18:20:48.654708Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T18:21:05.814Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-527g-ff96-x6wj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "apostrophe",
          "vendor": "apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.25.0, \u003c 4.33.0"
            }
          ]
        },
        {
          "product": "ai-helper",
          "vendor": "@apostrophecms",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0-beta.10, \u003c 1.0.0-beta.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider URL and invoke image acceptance on a deployment using local relative storage with no trusted global base URL. The server resolves the fixed uploads path against a request-controlled Host-derived origin, enabling bounded server-side requests to an attacker-selected host, port, and HTTP origin, but not arbitrary-path retrieval or the stored-provider and absolute-storage configurations. This issue is fixed in AI helper 1.0.0-beta.13."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T17:43:53.227Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-527g-ff96-x6wj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-527g-ff96-x6wj"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/commit/9500b8b0e1d630d5e07fbb5fd2c25ed0943845ce"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/commit/f84fd41cbf6c22eb8d0008fc9c25df1f7130b350"
        },
        {
          "name": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/ai-helper@1.0.0-beta.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/apostrophecms/apostrophe/releases/tag/@apostrophecms/ai-helper@1.0.0-beta.13"
        }
      ],
      "source": {
        "advisory": "GHSA-527g-ff96-x6wj",
        "discovery": "UNKNOWN"
      },
      "title": "ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-113671",
    "datePublished": "2026-10-20T17:43:53.227Z",
    "dateReserved": "2026-10-20T14:27:46.642Z",
    "dateUpdated": "2026-10-20T18:21:05.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T19:22:04.700266Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T19:22:15.189Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:misp:misp_modules_\\(html_to_markdown_expansion_module\\):*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "misp_modules/modules/expansion/html_to_markdown.py"
          ],
          "product": "misp-modules",
          "programFiles": [
            "misp_modules/modules/expansion/html_to_markdown.py"
          ],
          "repo": "https://github.com/misp/misp-modules",
          "vendor": "MISP",
          "versions": [
            {
              "lessThanOrEqual": "3.0.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "elhoim"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Claude Opus 5 (1M context)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\u003c/p\u003e\u003cp\u003eAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server\u0027s network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.\u003c/p\u003e\u003cp\u003eThe security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources.\u003c/p\u003e"
            }
          ],
          "value": "The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL validation function. The BLOCKED_RANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the following ranges were not blocked: 0.0.0.0/8 (unspecified, which routes to loopback on Linux), 100.64.0.0/10 (carrier-grade NAT per RFC 6598), ::/128 (IPv6 unspecified), fc00::/7 (IPv6 Unique Local Addresses), and fe80::/10 (IPv6 link-local). The existing list only covered IPv4 loopback (127.0.0.0/8), RFC 1918 private ranges, IPv4 link-local (169.254.0.0/16), and IPv6 loopback (::1/128).\n\nAn authenticated user with the ability to create or modify MISP attributes that trigger the html_to_markdown expansion module could supply URLs pointing to these unblocked internal address ranges. Because the module fetches the URL server-side to convert HTML content to Markdown, the request is made from the MISP server\u0027s network context. This allows an attacker to probe and read responses from internal services, carrier-grade NAT infrastructure, or link-local endpoints that would otherwise be unreachable from external networks. IPv4-mapped IPv6 forms (e.g., [::ffff:0.0.0.0]) also bypassed the existing checks.\n\nThe security impact is primarily confidentiality: an attacker can read data served by internal services reachable from the MISP server. The MISP instance itself is not compromised, but it is abused as a proxy to access otherwise restricted network resources."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-12",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-12 Server Side Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "format": "SSVC",
          "other": {
            "content": {
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "yes"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "Supplier",
              "timestamp": "2026-10-19T22:15:01Z",
              "version": "2.0.3"
            },
            "type": "SSVC"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T06:02:08.508Z",
        "orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "shortName": "CIRCL"
      },
      "references": [
        {
          "name": "Security patch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges.\u003c/p\u003e"
            }
          ],
          "value": "The fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()",
      "x_gcve": [
        {
          "extensions": {
            "bcp-05-x-01": {
              "ai_annotations": [
                {
                  "ai_level": "generated",
                  "description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
                  "gna_source": 1,
                  "models": [
                    {
                      "gna_source": 1,
                      "identifier": "qwen3.8:27b",
                      "name": "qwen3.8:27b",
                      "source": "ollama"
                    }
                  ],
                  "review_status": "partial",
                  "scope": "record",
                  "tags": [
                    "ai-computer-assisted:llm-generated",
                    "ai-computer-assisted:classification"
                  ]
                }
              ]
            },
            "bcp-05-x-02": {
              "x_patch2vuln": {
                "assumptions": [
                  "PR:L assumes that creating or modifying a MISP attribute to trigger the html_to_markdown expansion module requires authenticated access. MISP typically enforces authentication for attribute operations, but the patch does not explicitly state the authentication model.",
                  "SC:H assumes the MISP server can reach internal services (e.g., cloud metadata at 169.254.169.254, internal admin panels, or CGNAT infrastructure) and that the responses are returned to the attacker via the Markdown conversion output. The actual impact depends on the server\u0027s network topology.",
                  "The exact affected version range is not specified in the patch. The nearest tag is v3.0.13 with 139 commits after the fix, but the precise release containing the fix is not identified.",
                  "CAPEC-12 is selected as the closest match; no alternative CAPEC more precisely describes an SSRF via incomplete IP-range validation in a URL-fetching module.",
                  "The patch does not indicate whether the module follows redirects to additional unblocked ranges; MAX_REDIRECTS is set to 10, and the redirect target validation is not shown in this patch. If redirect targets are not re-validated, the SSRF surface may be broader than what this patch addresses."
                ],
                "capecRationale": [
                  {
                    "capecId": "CAPEC-12",
                    "rationale": "The patch directly addresses an SSRF condition: the application fetches a URL on behalf of the user, and the validation logic failed to block requests to internal and restricted IP ranges. An attacker crafts a URL with a blocked-range IP (e.g., http://0.0.0.0/admin or http://[fe80::1]/) to cause the MISP server to issue a request to an internal service. This is the canonical CAPEC-12 pattern. No uncertainty in this mapping."
                  }
                ],
                "commit": "98a1c2c2f297665dd8d4609e9cd644007a57516b",
                "confidence": "medium",
                "credits": [
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "elhoim"
                  },
                  {
                    "lang": "en",
                    "type": "remediation developer",
                    "value": "Claude Opus 5 (1M context)"
                  }
                ],
                "cvssRationale": "AV:N: The vulnerable URL is supplied via a MISP attribute over the network. AC:L: Crafting a URL with a blocked-range IP is straightforward; no race or special timing is needed. AT:N: No manipulation of the target service is required. PR:L: Creating or modifying a MISP attribute that triggers the expansion module requires authenticated access (assumed; MISP typically requires authentication for attribute operations). UI:N: No victim interaction beyond the initial attribute creation is needed. VC:N, VI:N, VA:N: The MISP server itself is not compromised; it is used as a proxy. SC:H: The SSRF allows reading responses from internal services (e.g., cloud metadata endpoints, internal admin panels), representing a high confidentiality impact on the target system. SI:N, SA:N: The module performs a GET-style fetch for HTML-to-Markdown conversion; no evidence of write or security-impact on the target.",
                "fixSummary": "The fix extends the BLOCKED_RANGES list in is_safe_url() to include the previously missing IP address ranges: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. The existing IPv4-mapped IPv6 normalisation logic ensures that mapped forms (e.g., ::ffff:0.0.0.0) are also blocked. Regression tests are added covering both literal IP addresses in URLs and hostnames that resolve to the newly blocked ranges.",
                "generatedAt": "2026-10-19T22:15:01.979194Z",
                "generator": "patch2vuln.py",
                "model": "qwen3.8:27b",
                "modelComparison": {
                  "rankings": [
                    {
                      "agreementScore": 11,
                      "assumptionCount": 5,
                      "confidence": "medium",
                      "model": "qwen3.8:27b",
                      "score": 7
                    }
                  ],
                  "selectedModel": "qwen3.8:27b",
                  "selectionMethod": "deterministic-consensus-v1",
                  "selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
                },
                "patchSha256": "a1b0755b91ddfee8869bba03e3d5eb00ffedd8e753d6d03e40c059d056567b28",
                "patchSummary": "In misp_modules/modules/expansion/html_to_markdown.py, five new ipaddress.ip_network() entries are added to the BLOCKED_RANGES list: 0.0.0.0/8, 100.64.0.0/10, ::/128, fc00::/7, and fe80::/10. In tests/test_html_to_markdown.py, two new test methods are added: test_blocks_unspecified_shared_ula_and_link_local_literals verifies that is_safe_url() returns False for literal URLs using each blocked range (including IPv4-mapped IPv6 forms), and test_blocks_hostnames_resolving_to_ula_addresses verifies that a hostname resolving to an fc00::/7 address is rejected.",
                "patchTruncated": false,
                "patches": [
                  {
                    "commit": "98a1c2c2f297665dd8d4609e9cd644007a57516b",
                    "date": "Fri, 25 Sep 2026 22:15:46 +0000",
                    "patchSha256": "a1b0755b91ddfee8869bba03e3d5eb00ffedd8e753d6d03e40c059d056567b28",
                    "source": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch",
                    "sourceUrl": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch",
                    "subject": "fix: [html_to_markdown] block unspecified, shared, ULA and"
                  }
                ],
                "source": "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch",
                "ssvc": {
                  "options": [
                    {
                      "Exploitation": "none"
                    },
                    {
                      "Automatable": "yes"
                    },
                    {
                      "Technical Impact": "partial"
                    }
                  ],
                  "role": "Supplier",
                  "timestamp": "2026-10-19T22:15:01Z",
                  "version": "2.0.3"
                },
                "subject": "fix: [html_to_markdown] block unspecified, shared, ULA and",
                "tagVersionBoundary": {
                  "commits_after_fix": 139,
                  "repository": "https://github.com/misp/misp-modules",
                  "tag": "v3.0.13",
                  "version": "3.0.13",
                  "version_type": "semver"
                },
                "weaknessRationale": [
                  {
                    "cweId": "CWE-918",
                    "rationale": "The html_to_markdown module fetches a user-supplied URL server-side. The incomplete IP range allow/block list permitted requests to internal, link-local, and otherwise restricted network destinations, constituting a classic SSRF."
                  },
                  {
                    "cweId": "CWE-20",
                    "rationale": "The is_safe_url() function\u0027s BLOCKED_RANGES list was incomplete, failing to validate against all non-routable and internally significant IP address ranges. This is the root-cause input validation deficiency enabling the SSRF."
                  }
                ]
              }
            },
            "bcp-05-x-03": {
              "x_timeline": {
                "events": [
                  {
                    "description": "Corrective change authored (98a1c2c2f297665dd8d4609e9cd644007a57516b): fix: [html_to_markdown] block unspecified, shared, ULA and",
                    "id": "evt-fix-developed-1",
                    "references": [
                      "https://github.com/misp/misp-modules/commit/98a1c2c2f297665dd8d4609e9cd644007a57516b.patch"
                    ],
                    "timestamp": "2026-09-25T22:15:46Z",
                    "type": "fix-developed"
                  }
                ]
              }
            }
          },
          "recordType": "advisory",
          "vulnId": "GCVE-1-2026-20287"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
    "assignerShortName": "CIRCL",
    "cveId": "CVE-2026-112991",
    "datePublished": "2026-10-19T22:19:50.011Z",
    "dateReserved": "2026-10-19T22:19:44.187Z",
    "dateUpdated": "2026-10-20T19:22:15.189Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112363",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T15:59:21.230894Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T16:33:37.088Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/crawl4ai",
          "product": "crawl4ai",
          "repo": "https://github.com/unclecode/crawl4ai",
          "vendor": "unclecode",
          "versions": [
            {
              "lessThanOrEqual": "0.9.5",
              "status": "affected",
              "version": "0.8.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:kidocode:crawl4ai:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "0.9.5",
                  "versionStartIncluding": "0.8.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "2gg-bit"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani"
        }
      ],
      "datePublic": "2026-09-27T04:07:58.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on port 443, probing reachability and leaking certificate details."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T15:28:59.792Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/unclecode/crawl4ai/pull/2304"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/unclecode/crawl4ai/blob/v0.9.5/crawl4ai/ssl_certificate.py"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/unclecode/crawl4ai/blob/v0.9.5/crawl4ai/async_crawler_strategy.py"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/unclecode/crawl4ai/blob/v0.9.5/deploy/docker/utils.py"
        },
        {
          "name": "VulnCheck Advisory: Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/crawl4ai-0.8.7-through-0.9.5-ssrf-bypass-via-sslcertificate-from-url-url-userinfo"
        }
      ],
      "title": "Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-112363",
    "datePublished": "2026-10-19T15:28:59.792Z",
    "dateReserved": "2026-10-19T15:05:31.182Z",
    "dateUpdated": "2026-10-19T16:33:37.088Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112358",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T14:57:33.537171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T14:58:56.991Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/submit/986821"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:tibillet:lespass:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "APIv1"
          ],
          "product": "Lespass",
          "vendor": "TiBillet",
          "versions": [
            {
              "status": "affected",
              "version": "10e87909c5d526dffa6d424c104fc12860740537"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Plus0ne_27 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function get_img_from_url of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument img_url/image_url can lead to server-side request forgery. The attack can be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The vendor confirms: \"[T]he fix (destination IP validation, redirect re-checks, timeout and size limit on remote image download) is already planned in our v2 API, which replaces the affected v1 endpoints. The v1 API, including the three affected serializers, will be removed in our next major release.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4.3,
            "vectorString": "AV:N/AC:H/Au:M/C:P/I:P/A:P/E:ND/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T21:15:15.519Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-422393 | TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/422393"
        },
        {
          "name": "VDB-422393 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/422393/cti"
        },
        {
          "name": "CVE-2026-112358 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-112358"
        },
        {
          "name": "Submit #986821 | TiBillet Cooperative  Lespass (Django/DRF cooperative back-office and ticketing platform) commit 56c1865  Server-Side Request Forgery (SSRF) \u2014 CWE-918",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/986821"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-19T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-19T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-19T16:50:29.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-112358",
    "datePublished": "2026-10-19T21:15:15.519Z",
    "dateReserved": "2026-10-19T14:45:23.114Z",
    "dateUpdated": "2026-10-20T14:58:56.991Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112308",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T18:23:18.177311Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:23:27.612Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:pypi/crewai-tools",
          "product": "crewai-tools",
          "repo": "https://github.com/crewAIInc/crewAI",
          "vendor": "crewAIInc",
          "versions": [
            {
              "lessThanOrEqual": "1.15.28",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:crewai:crewai:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.15.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SashaMIT"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Zachariah Mithani"
        }
      ],
      "datePublic": "2026-08-08T09:18:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T15:28:57.761Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/crewAIInc/crewAI/pull/6870"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/crewAIInc/crewAI/blob/1.15.28/lib/crewai-tools/src/crewai_tools/tools/selenium_scraping_tool/selenium_scraping_tool.py"
        },
        {
          "name": "VulnCheck Advisory: crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/crewai-tools-through-1.15.28-ssrf-via-seleniumscrapingtool"
        }
      ],
      "title": "crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-112308",
    "datePublished": "2026-10-19T15:28:57.761Z",
    "dateReserved": "2026-10-19T14:14:29.070Z",
    "dateUpdated": "2026-10-19T18:23:27.612Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-112299",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T15:03:45.971086Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T15:04:50.594Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/submit/986838"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:smrealms:smr:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Album Website"
          ],
          "product": "smr",
          "vendor": "smrealms",
          "versions": [
            {
              "status": "affected",
              "version": "f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Plus0ne_27 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. This patch is called cb402e7f4e70b617b59d8c55dbe926b951ceb4a8. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T20:15:27.596Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-422345 | smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/422345"
        },
        {
          "name": "VDB-422345 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/422345/cti"
        },
        {
          "name": "CVE-2026-112299 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-112299"
        },
        {
          "name": "Submit #986838 | smrealms project contributors smr (Space Merchant Realms open-source game engine)  commit 9f7c8a9 Server-Side Request Forgery (SSRF) \u2014 CWE-918",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/986838"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/smrealms/smr/pull/2579"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/smrealms/smr/commit/cb402e7f4e70b617b59d8c55dbe926b951ceb4a8"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/smrealms/smr/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-07T00:00:00.000Z",
          "value": "Countermeasure disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-19T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-19T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-19T16:04:09.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-112299",
    "datePublished": "2026-10-19T20:15:27.596Z",
    "dateReserved": "2026-10-19T13:58:55.048Z",
    "dateUpdated": "2026-10-20T15:04:50.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ptbsare:anx-calibre-manager:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "LLM Configuration Handler"
          ],
          "product": "anx-calibre-manager",
          "vendor": "ptbsare",
          "versions": [
            {
              "status": "affected",
              "version": "1.13.0"
            },
            {
              "status": "affected",
              "version": "1.13.1"
            },
            {
              "status": "affected",
              "version": "1.13.2"
            },
            {
              "status": "affected",
              "version": "1.13.3"
            },
            {
              "status": "affected",
              "version": "1.13.4"
            },
            {
              "status": "affected",
              "version": "1.13.5"
            },
            {
              "status": "affected",
              "version": "1.13.6"
            },
            {
              "status": "affected",
              "version": "1.13.7"
            },
            {
              "status": "affected",
              "version": "1.13.8"
            },
            {
              "status": "affected",
              "version": "1.13.9"
            },
            {
              "status": "affected",
              "version": "1.13.10"
            },
            {
              "status": "affected",
              "version": "1.13.11"
            },
            {
              "status": "affected",
              "version": "1.13.12"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Plus0ne_27 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument base_url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T19:45:05.618Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-422342 | ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/422342"
        },
        {
          "name": "VDB-422342 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/422342/cti"
        },
        {
          "name": "CVE-2026-112297 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-112297"
        },
        {
          "name": "Submit #986822 | ptbsare (anx-calibre-manager project contributors) anx-calibre-manager (Flask web companion for the Calibre e-book manager)  v1.13.12  Server-Side Request Forgery (SSRF) \u2014 CWE-918",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/986822"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-19T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-19T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-19T16:00:31.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-112297",
    "datePublished": "2026-10-19T19:45:05.618Z",
    "dateReserved": "2026-10-19T13:55:26.019Z",
    "dateUpdated": "2026-10-19T19:45:05.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:composer/krayin/laravel-crm",
          "product": "laravel-crm",
          "repo": "https://github.com/krayin/laravel-crm",
          "vendor": "krayin",
          "versions": [
            {
              "lessThan": "2.2.7",
              "status": "affected",
              "version": "2.2.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adham Mohammed Abd El-Kawi"
        }
      ],
      "datePublic": "2026-10-09T13:37:12.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint() validation and an internal address when Guzzle re-resolves, sending blind requests to internal services and cloud metadata endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T13:55:31.283Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch",
            "issue-tracking"
          ],
          "url": "https://github.com/krayin/laravel-crm/pull/2683"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/krayin/laravel-crm/commit/64b9125f33a7eb2ef9916d0e5fd8215c7f6a8c28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/krayin/laravel-crm/blob/v2.2.6/packages/Webkul/Automation/src/Services/WebhookService.php"
        },
        {
          "name": "Krayin CRM v2.2.7 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/krayin/laravel-crm/releases/tag/v2.2.7"
        },
        {
          "name": "VulnCheck Advisory: Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/krayin-crm-2.2.5-before-2.2.7-ssrf-filter-bypass-via-dns-rebinding"
        }
      ],
      "title": "Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-112288",
    "datePublished": "2026-10-19T13:55:31.283Z",
    "dateReserved": "2026-10-19T13:25:33.179Z",
    "dateUpdated": "2026-10-19T13:55:31.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}