PULSE
EN
FEED
ransomlamashtu reclama a Gräfliches Hofbrauhaus Freising · DE · Agriculture and Food Productionransomlamashtu reclama a VERGI Muenster · DE · Energy & Utilitiesransomn0n reclama a Heritage Senior Living · US · Healthcareransomlamashtu reclama a FuG-Gruppe · DE · Otherransomlamashtu reclama a MECA-PRECIS · FR · Manufacturingransomlamashtu reclama a WEPOS Chemie · DE · Manufacturingransomsilentransomgroup reclama a K.r.. ...s · Not Foundransombraincipher reclama a novagroupgbc.com · GB · Otherransombraincipher reclama a oflaherty-law.com · IE · Professional Servicesransombraincipher reclama a clinicaromero.com · AR · Healthcareransombraincipher reclama a sodali.com · US · Professional Servicesransombraincipher reclama a srsnodgrass.com · US · Professional Servicesransombraincipher reclama a prosomnus.com · US · Healthcareransombraincipher reclama a olyortho.com · US · Healthcareransomlamashtu reclama a Gräfliches Hofbrauhaus Freising · DE · Agriculture and Food Productionransomlamashtu reclama a VERGI Muenster · DE · Energy & Utilitiesransomn0n reclama a Heritage Senior Living · US · Healthcareransomlamashtu reclama a FuG-Gruppe · DE · Otherransomlamashtu reclama a MECA-PRECIS · FR · Manufacturingransomlamashtu reclama a WEPOS Chemie · DE · Manufacturingransomsilentransomgroup reclama a K.r.. ...s · Not Foundransombraincipher reclama a novagroupgbc.com · GB · Otherransombraincipher reclama a oflaherty-law.com · IE · Professional Servicesransombraincipher reclama a clinicaromero.com · AR · Healthcareransombraincipher reclama a sodali.com · US · Professional Servicesransombraincipher reclama a srsnodgrass.com · US · Professional Servicesransombraincipher reclama a prosomnus.com · US · Healthcareransombraincipher reclama a olyortho.com · US · Healthcare
← Todos los CVEs
CVE Watch14 oct 2026

CVE-2026-85345

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server

CVSS

4.1

Medio

EPSS

0.2%

p14

KEV

—

Exploit Today

4

0-100

Publicado: 14 oct 2026 · Última mod.: 14 oct 2026 · CWE-918

EPSS · 30d
0.2%EPSS · 30 días0.2%
2026-10-142026-10-20
Descripción técnica

The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacker.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-175576.5 MED
—
——0A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod.22hCVE-2026-1140805.0 MED
—
——0Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send requests by setting unvalidated alert-channel webhook URLs. Attackers can create alert channels pointing to loopback, internal, or cloud metadata addresses, then trigger alerts to probe internal service reachability and send signed POST requests.1dCVE-2026-1140765.4 MED
—
——0Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud metadata addresses and trigger alerts to scan internal hosts, send state-changing POSTs, or reach IMDSv1 via redirects.1dCVE-2026-1140745.4 MED
—
——0Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF protections by targeting the non-global 198.18.0.0/15 benchmarking range. Attackers can configure alert-channel webhooks pointing at internally routed services in this range, which isUnsafeIPv4 omits, to perform blind internal probing and limited state-changing POST requests.1dCVE-2026-1140625.3 MED
—
——0SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.1dCVE-2026-1096824.7 MED
—
——0Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.1d