CVE-2026-78205 BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...

CVE-2026-78205

BentoML versions 1.4.19 through 1.4.39 are affected by a Server-Side Request Forgery (SSRF) vulnerability. The outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP ranges but fails to reject the RFC 6598 shared address space (100....

CVE-2026-78205 BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...

PT-2026-79798

BentoML's outbound connection safeguard make safe connect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs...

MAL-2026-14397 Malicious code in sm-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bc8dabb0ecf46dc57dd07dacdf28c9cddf629ffb8e9b0cea75e71cd999feaf0 [email protected] declares preinstall and postinstall lifecycle scripts in package.json that invoke curl against a hardcoded bare-IP URL over plain...

CVE-2026-53509

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

CVE-2026-63466

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment...

CVE-2026-63044

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63044

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache InLong (versions 2.0.0 through 2.3.x) due to an authenticated SSRF via POST /api/node/testConnection . Any authenticated user, regardless of administrative privileges, can force the InLong Manager server to make outbound HTTP req...

EUVD-2026-63477

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-77074 n8n before 1.123.69 SSRF via Edit Image Node

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...

CVE-2026-63044: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

PT-2026-79052

Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An authenticated user, regardless of whether they possess an administrative role, can trigger the InLong Manager server to initiate outbound HTTP requests or TCP connections to arbitrary...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the UDP inbound adapter process. An attacker can cause the server to send outbound UDP datagrams to arbitrary internal or external hosts and ports by sending specially crafted UDP packets containing...

CVE-2026-76361

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

CVE-2026-76361

Splunk SOAR versions below 8.6.0 are affected by an SSRF vulnerability in the /rest/support/connectivity/.../check_connectivity REST API endpoint, which fails to validate destination hosts before initiating outbound connections, allowing an Administrator-role user to probe internal network reacha...

CVE-2026-19875

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...

CVE-2026-19875 Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint...

CVE-2026-19875

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain an authentication bypass in the POST /api/v2/registration/ endpoint (CWE-306). An unauthenticated remote attacker can overwrite the server's registered admin email address and trigger outbound telemetry calls, enabling the instance to be abus...