EUVD-2026-72910

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

Overview A Server-Side Request Forgery SSRF vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12. The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections. An authenticated...

EEF-CVE-2026-82757 ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF

Summary Server-Side Request Forgery SSRF vulnerability in ash-project ashauthenticationoauth2server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses. publicip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforce...

CVE-2026-86122 Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network...

EUVD-2026-71954

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network...

CVE-2026-86122

Rowboat through version 0.9.1 is affected by a Server-Side Request Forgery (SSRF) vulnerability caused by insufficient validation of custom MCP server and webhook URLs. Authenticated users can configure these URLs to point at internal services and cloud metadata endpoints , enabling enumeration o...

EUVD-2026-71796

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-86100

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

PT-2026-86393

Name of the Vulnerable Software and Affected Versions Rowboat versions prior to 0.9.2 Description Authenticated users can configure arbitrary destinations because the software fails to validate custom MCP server and webhook URLs. This allows attackers to point these URLs at internal services and...

CVE-2026-86100 Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-63464 Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allowprivate: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

CVE-2026-85699

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the...

CVE-2026-85699 jina-ai reader server-side request forgery via redirect validation bypass

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the...

EUVD-2026-71122

OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...

CVE-2026-85609 Openpanel before 2.3.0 SSRF via Site Checker Endpoint

Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery SSRF vulnerability in the GET /tools/site-checker endpoint apps/api/src/controllers/tools.controller.ts. The endpoint passes a user-supplied url query parameter to fetchWithRedirects and performs server-side...

CVE-2026-85609

Openpanel before 2.3.0 is affected by an unauthenticated SSRF in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The user-supplied url query parameter is passed to fetchWithRedirects() without SSRF or IP validation, allowing a remote attacker to reach cloud in...

Linux Distros Unpatched Vulnerability : CVE-2026-76177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV...

UBUNTU-CVE-2026-76177

Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...

CVE-2026-76177 Multiple vulnerabilities in Ocsreports for OCS Inventory NG

Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory...

CVE-2026-76177

Ocsreports for OCS Inventory NG contains a Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint. The root cause is insufficient validation of the HTTPS_SERV and FILE_SERV parameters, allowing an authenticated user with operator privileges to supply ...