IMDSpoof

IMDSPOOF IMDSPOOFは、AWS IMDSサービスを偽装するサイバーディセプション（欺瞞）ツールです。攻撃者がクラウド環境で権限昇格や横移動を行う方法の一つとして、http://169.254.169.254/latest/meta-data/iam/security-credentials/ にあるIMDSサービスエンドポイントからAWSアクセスキーを取得することがあります。このツールはそのエンドポイントを偽装し、169.254.169.254...

CVE-2026-55160

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

EUVD-2026-78818

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol MCP servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP...

CVE-2025-64709: Server-Side Request Forgery (SSRF)

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery SSRF vulnerability in the Typebot webhook block HTTP Request component functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance...