CVE-2026-57566

The Readest ebook reader (versions prior to 0.11.10 ) contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /api/opds/proxy route. The application fails to restrict URL schemes or block private, loopback, link-local, or metadata hosts when fetching attacker-controlle...

CVE-2026-122140

The software Trawl versions 1.5.0 before 1.10.0 is vulnerable to a Server-Side Request Forgery (SSRF) . This vulnerability allows unauthenticated attackers to bypass the MCP outbound URL policy by utilizing IPv4-mapped IPv6 addresses . Attackers can provide hex-normalized addresses (e.g., ::ffff:...

EUVD-2026-117094

Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback...

FormCraft3 <= 3.9.15 - Server-Side Request Forgery

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. id: CVE-2026-60105 info: name: Monst...

Kan <= 0.5.4 - Server-Side Request Forgery

Kan, an open-source project management tool Trello alternative, versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled url query parameter straight to a server-side fetch...

LocalAI < 4.6.0 - Server-Side Request Forgery

LocalAI before 4.6.0 is affected by an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint. The gallery url field is passed to the gallery config fetcher without validation, allowing an unauthenticated attacker to make the server issue HTTP requests to...

Gotenberg <= 8.30.1 - Server Side Request Forgery

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

MagicMirror <= 2.35.0 - Server-Side Request Forgery

An unauthenticated Server-Side Request Forgery SSRF vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment...

GeoNetwork - Server-Side Request Forgery (SSRF)

GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery SSRF in the SLD tool. The POST /srv/api/tools/ogc/sld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any...

EUVD-2026-115853

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instanceurl, api, or webhookurl to internal addresses a...

PT-2026-136188

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.24.0 Description Station users with WebHooks permission can bypass the UserUrlFilter guard using the Mastodon, Telegram, GroupMe, and RadioReg connectors. By setting the instance url, api, or webhookurl variables ...

Malicious code in @ifasn/mmd-doc-mcp (npm)

Source: amazon-inspector e3b58b8adeff2784f4fdeb4bf0e873e5797893619b3bc36c55de55b85efca1b7 On startup, bin/main probes cloud instance-metadata endpoints for AWS including the IMDSv2 token path, GCP, Azure, and Alibaba including the RAM security-credentials/ role path under variables named...

Malicious code in @ifasn/md-doc-mcp (npm)

Source: amazon-inspector 808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb The package is advertised as a markdown toolkit MCP server TOC generation, word count, table formatting but on require of its main module and on startup of its md-doc-mcp bin it probes cloud-provider...

Malicious code in @ifasn/mmd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b58b8adeff2784f4fdeb4bf0e873e5797893619b3bc36c55de55b85efca1b7 On startup, bin/main probes cloud instance-metadata endpoints for AWS including the IMDSv2 token path, GCP, Azure, and Alibaba including the RAM...

MAL-2026-18488 Malicious code in @ifasn/mmd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b58b8adeff2784f4fdeb4bf0e873e5797893619b3bc36c55de55b85efca1b7 On startup, bin/main probes cloud instance-metadata endpoints for AWS including the IMDSv2 token path, GCP, Azure, and Alibaba including the RAM...

Malicious code in @ifasn/md-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb The package is advertised as a markdown toolkit MCP server TOC generation, word count, table formatting but on require of its main module and on...

MAL-2026-18486 Malicious code in @ifasn/md-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb The package is advertised as a markdown toolkit MCP server TOC generation, word count, table formatting but on require of its main module and on...

nextssrf

╔══════════════════════════════════════════════════════════════╗ ║ NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF ║ ║ Affected: 13.4.13 → 15.5.15, 16.0.0 → 16.2.4 ║ ║ @mitsec / ynsmroztas — Bug Bounty Tooling ║...

CVE-2026-3333-DNS-Rebinding-to-Steal-Cloud-Metadata

CVE-2026-3333 – DNS Rebinding to Steal Cloud Metadata Program Code Python attacker server + vulnerable app !/usr/bin/env python3 dnsrebindingserver.py - Malicious DNS server that alternates between attacker IP and 169.254.169.254 import socket, threading, time This simple server resolves any...