CVE-2026-106032: Server-Side Request Forgery (SSRF)

Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might allow an authenticated remote actor in the same AWS account to cause the environment of a user importing a Bedrock Agent to issue arbitrar...

CVE-2026-102091 Kiteworks Secure Data Forms server-side request forgery

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

PT-2026-103529

Name of the Vulnerable Software and Affected Versions Kiteworks Secure Data Forms versions prior to 9.5.0 Description An issue exists that allows an unauthenticated remote attacker to perform Server-Side Request Forgery SSRF, a technique where the attacker induces the server to make requests to a...

CVE-2026-76971

SAP Manufacturing Integration and Intelligence contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execut...

CVE-2026-76971 Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence

Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...

CVE-2026-76971 Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence

Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...

CVE-2026-76971: Server-Side Request Forgery (SSRF)

Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...

CVE-2026-65057 Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck

Keep commit 91c75e0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the invoice PDF rendering process when Markdown image URLs are processed. An attacker can cause the server to make arbitrary outbound requests by supplying specially crafted Markdown content containin...

CVE-2026-49345

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery SSRF vulnerability exists in Mercator's CVE configuration panel /admin/config/parameters. The testProvider method in ConfigurationController passes...

CVE-2026-2290

The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This makes it possible for authenticated attackers, with Administrator-level access, to make web requests to initiate arbitrary outbound requests from the...

CVE-2026-28508 Idno: Unauthenticated SSRF via URL Unfurl Endpoint

Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service endpoint to be trivially bypassed by any unauthenticated remote attacker. Combined with the absence of a login requirement on the endpoin...