CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)

imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXYALLOWLOOPBACKSOURCEADDRESSES is set to false, letting local services be exposed, exploit requires network access. id: CVE-2025-24354 info: name: Imgproxy 3.27.2 - Server-Side Request Forgery SSRF author:...

PT-2026-66837

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

CVE-2026-64870 MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation

MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.updatetool passes caller-supplied downloadurl and downloadcallbackurl values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user...

SUSE CVE-2026-55671

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...

CVE-2026-67346

Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the issafeurl function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve ...

CVE-2026-67346

Swarms 6.8.1 is affected by a server-side request forgery in the _is_safe_url function due to hostname validation via DNS resolution. This allows attackers to supply user-controlled image or audio URLs resolving to private, loopback, or metadata addresses to reach internal services and exfiltrate...

CVE-2026-47873

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces 0.0.0.0 rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier...

CVE-2026-47873

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces 0.0.0.0 rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier...

CVE-2026-47873 Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces 0.0.0.0 rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier...

EUVD-2026-50972

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces 0.0.0.0 rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier...

EUVD-2026-43722

Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network...

GHSA-VX7X-VCC2-C44G datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

Summary datamodel-code-generator's anti-SSRF guard validates the resolved IP of a fetch target once and then lets httpx perform its own independent DNS resolution to connect, so the validated address is never pinned. A hostname that resolves to a public IP at validation time and a private IP at...

CVE-2026-58404

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

PT-2026-65613

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.9.1 through 0.60.1 Description The get body function in src/datamodel code generator/http.py fails to validate host or IP addresses when processing targets provided via the --url argument or through redirect...

EEF-CVE-2026-42792 epmd permanent DoS via EMFILE on accept(2) in erts

Summary Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts epmd allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon epmd via connection slot exhaustion. The do\accept function in erts/epmd/src/epmd\srv.c calls epmd\cleanup\exi...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Update of Reference Count (CVE-2025-38732)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfreject: don't leak dst refcount for loopback packets recent patches to add a WARN when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skbdstcheckunset include/linux/skbuff.h:1164 inlin...

SUSE CVE-2026-50251

In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...

GO-2026-6023 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses in github.com/cloudreve/Cloudreve

Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses in github.com/cloudreve/Cloudreve...

CVE-2026-50251

In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled set to any value greater than zero, glue records of 0.0.0.0/::0 can short-circuit Unbound, on systems that can direct such traffic, by issuing DNS queries and receiving seemingly unwanted replies...