CVE-2026-33693

CVE-2026-33693: SSRF mediante bypass de 0.0.0.0 en v4isinvalid de activitypub-federation-rust CVSS 6.5 Moderado Palabras clave: SSRF, 0.0.0.0, bypass de validación de IP, activitypub-federation, Lemmy, Rust, ActivityPub Tabla de contenidos Descripción general Detalles de la vulnerabilidad Análisi...

SearXNG MCP Server: Additional hardened-mode SSRF bypasses

Summary mcp-searxng has a hardened-mode URL-reading feature intended to prevent weburlread from reaching private or internal network resources. PR 79 appears to address one SSRF class: hostnames that resolve to private or internal addresses under hardened mode. I tested PR 79 locally and confirme...

PYSEC-2026-3659 compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Summary compliance-trestle 4.0.3 latest ships an URLSecurityValidator in trestle/core/remote/security.py to block SSRF to loopback / link-local / cloud-metadata endpoints from the HTTPSFetcher and SFTPFetcher remote-fetch paths. The allowlist is incomplete and can be bypassed by four equivalent...

PT-2026-80757

Summary mcp-searxng has a hardened-mode URL-reading feature intended to prevent web url read from reaching private or internal network resources. PR 79 appears to address one SSRF class: hostnames that resolve to private or internal addresses under hardened mode. I tested PR 79 locally and...