CVE-2026-116280

The record

A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may be launched remotely. Upgrading to version 5.2.0 is able to address this issue. It is suggested to upgrade the affected component. The route has been removed and replaced with /general/test-proxy in 5.2.0.

Affected packages

Related vulnerabilities

• CVE-2026-121581 A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. CWE-918
• CVE-2026-121580 Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server… CWE-918
• CVE-2026-120715 Server-side request forgery in the Active Directory credential validation in Devolutions… CWE-918
• CVE-2026-105822 The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability… CWE-918
• CVE-2026-121561 Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request… CWE-918
• CVE-2026-114582 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-918
• CVE-2026-111362 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-918
• CVE-2026-121431 AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows… CWE-918