CVE-2026-86800

The Hide My WP Ghost WordPress plugin prior to 7.0.11 fails to properly validate a loopback security-check request before disabling its login and URL hiding protection. Because the verification value is not correctly checked, any unauthenticated visitor can craft a request with a missing or incor...

CVE-2026-86800 WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

CVE-2026-86800 WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

Server-Side Request Forgery (SSRF)

io.kestra, core is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled HTTP URI destinations, which allows an unauthenticated attacker to import and execute a flow that makes requests to internal services, loopback/link-local...

Server-Side Request Forgery (SSRF)

Nuxt OG Image is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled font URLs before performing server-side requests, which allows an unauthenticated attacker to access internal services such as loopback, private, link-local,...

CVE-2026-86800: Protection Mechanism Failure

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

PT-2026-95260

Name of the Vulnerable Software and Affected Versions Hide My WP Ghost versions prior to 7.0.11 Description An issue exists where the plugin fails to properly validate loopback security-check requests. When a request's verification value is missing or incorrect, the plugin disables its login and...

CVE-2026-92813

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

CVE-2026-92813 Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

EUVD-2026-81071

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

CVE-2026-92813 Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

CVE-2026-92813

Metabase (through 0.63.18 ) is vulnerable to a Server-Side Request Forgery (SSRF) caused by improper validation of the unspecified address 0.0.0.0 in custom GeoJSON URLs . An unauthenticated attacker can save a malicious GeoJSON entry using 0.0.0.0 and trigger server-side requests that reach loop...

CVE-2026-92813 Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

EUVD-2026-66389

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

CVE-2026-92813: Server-Side Request Forgery (SSRF)

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

CVE-2026-54688

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

CVE-2026-54688

CVE-2026-54688 is a Server-Side Request Forgery (SSRF) in mcp-searxng , a Model Context Protocol server providing AI assistants with web search and URL-reading via SearXNG. Prior to 1.2.0 , the web_url_read tool passes a caller-supplied URL to a server-side fetch path, but the internal-address gu...

CVE-2026-54549

meta-ads-mcp (a Model Context Protocol server for Meta Ads) contains a Server-Side Request Forgery (SSRF) in the upload_ad_image tool. Prior to v1.0.115 , an attacker-controlled image_url parameter is passed to httpx.AsyncClient with follow_redirects=True and no scheme, host, or IP validation , e...

CVE-2026-54637

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPort values through RegisterPeerTask and ReportPeerResult, storeHost copies tho...

CVE-2026-59973 mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec forwards untrusted OpenAPI url and spec inputs and...