CVE-2026-61743

Chartbrew , an open-source web application for generating charts from databases and APIs, is affected by a DNS rebinding SSRF bypass prior to version 5.2.2 . The root cause is a time-of-check-time-of-use (TOCTOU) flaw: server/modules/safeRequest.js calls validateOutboundUrl() to resolve and valid...

CVE-2024-38472

Создание модуля Metasploit для удаленного выполнения кода RCE на основе уязвимости SSRF CVE-2024-38472 в Apache HTTP Server на Windows — сложная задача, поскольку сам SSRF напрямую не приводит к RCE. Однако SSRF часто может быть шагом к достижению RCE, особенно если его можно использовать для...

CVE-2026-94401

MISP versions below 2.5.47 contain an arbitrary local file read and SSRF vulnerability in the XML export/import upload functionality. The root cause is insufficient validation: MISP failed to verify that the uploaded content was actually XML, allowing an authenticated user with modify permissions...

CVE-2024-54385

CVE-2024-54385 Radio Player = 2.0.82 - Неаутентифицированная Server-Side Request Forgery Описание Плагин Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player для WordPress уязвим к Server-Side Request Forgery во всех версиях до 2.0.82 включительно. Это позволяет неаутентифицированны...

CVE-2026-61681: Server-Side Request Forgery (SSRF)

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

CVE-2026-1641

The Wow Elements Addons for Elementor plugin for WordPress is affected by a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 1.11.2 . The root cause is the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get func...

Linux Distros Unpatched Vulnerability : CVE-2026-85732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a...

sap_bo_launchpad-ssrf-timing_attack

SAP BusinessObjects Launchpad SSRF и Timing Attack PoC Этот скрипт на Python является доказательством концепции PoC для выполнения SSRF подделка запросов на стороне сервера и атак по времени Timing Attack против SAP BusinessObjects Launchpad. Он предназначен для помощи исследователям безопасности...

CVE-2026-93597

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

EUVD-2026-82892

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2024-54330

CVE-2024-54330 Hurrakify bfdibc85r04ky96cie05dfzjjgigz...

CVE-2026-61793

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /og/d/ route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParam...

CVE-2026-63642

MagicMirror² Calendar 모듈의 SSRF MagicMirror²의 Calendar 모듈에 존재하는 서버 측 요청 위조Server-Side Request Forgery 취약점인 CVE-2026-63642 및 CVE-2026-63643에 대한 개념 증명 익스플로잇으로, 인증되지 않은 공격자가 서버로 하여금 내부 서비스에 임의의 HTTP 요청을 보내도록 강제할 수 있습니다. 설치: root@kitploit: $ npm init -y $ npm install socket.io-client 사용법: root@kitploi...

CVE-2023-27163

CVE-2023-27163 Это PoC для CVE-2023-27163 — уязвимости SSRF, присутствующей в request-baskets вплоть до v1.2.1. Эта уязвимость позволяет злоумышленникам получать доступ к чувствительным сетевым ресурсам через /api/baskets/name. request-baskets содержит функциональность, позволяющую пользователю...

CVE-2026-92795

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...

EUVD-2026-81058

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...

CVE-2026-92795 Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the...

CVE-2026-92795

Coze Studio through 0.5.1 contains a Server-Side Request Forgery (SSRF) vulnerability in its plugin system. The root cause is a failure to restrict the server URL supplied when registering plugin tools, allowing authenticated users to craft plugin requests that make the backend fetch internal ser...

CVE-2026-92789

Graylog versions through 7.1.4 are vulnerable to Server-Side Request Forgery (SSRF) via HTTP redirects. The root cause is that Graylog validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redirects . An attacker with lookup table or eve...