62746 matches found
PT-2026-85559
Name of the Vulnerable Software and Affected Versions OGX formerly Llama Stack versions up to commit fbe8e0f Description An unauthenticated server-side request forgery SSRF exists in the OpenAI-compatible 'POST /v1/responses' endpoint. The issue occurs because MCP tool definitions accept a server...
CVE-2026-85667: Missing Authentication for Critical Function
xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...
CVE-2026-80181: Server-Side Request Forgery (SSRF)
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
PT-2026-85696
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...
PT-2026-85428
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
CVE-2026-85695: Missing Authentication for Critical Function
FastChat contains an authentication bypass vulnerability in the /registerworker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompt...
CVE-2026-65818
Server-side request forgery ssrf in Power Automate allows an authorized attacker to elevate privileges over a network...
CVE-2026-49455 Waku: Cross-Origin CSRF on RSC Server Action Dispatch
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin or Sec-Fetch-Site header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registere...
CVE-2026-85305
Server-Side Request Forgery SSRF vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1...
CVE-2026-84761
Unauthenticated Server Side Request Forgery SSRF in LiteSpeed Cache = 7.9 versions...
GHSA-4MVJ-M6J5-PMF7 unstructured: Server-Side Request Forgery in the URL-based partitioning
Summary Server-Side Request Forgery in unstructured. The url= argument of partition, partitionhtml, and partitionmd is fetched via requests.get with no host validation. The response body is returned as Element text, so this is a full-read SSRF — attackers reach loopback admin APIs, internal HTTP...
EUVD-2026-63472
unstructured: Server-Side Request Forgery in the URL-based partitioning...
CVE-2026-85305
A Server-Side Request Forgery (SSRF) vulnerability affects the SEOPress WordPress plugin in versions from n/a through 10.1 . The flaw allows an attacker to force the server to make unintended requests. The CVSS v3.1 score is 5.4 (MEDIUM) , with a network vector, low complexity, low privileges req...
CVE-2026-85305 WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery SSRF vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1...
EUVD-2026-70557
Server-Side Request Forgery SSRF vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1...
CVE-2026-85305 WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery SSRF vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1...
WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by MYUNGYONG LEE in WordPress Plugin SEOPress versions = 10.1...
EUVD-2026-70583
Unauthenticated Server Side Request Forgery SSRF in LiteSpeed Cache = 7.9 versions...
CVE-2026-84761
CVE-2026-84761 affects the WordPress LiteSpeed Cache plugin in versions 7.9 and earlier , where an unauthenticated Server Side Request Forgery (SSRF) flaw is present. The CVSS v3.1 score is 7.2 (HIGH) with a Changed scope and low impacts to both confidentiality and integrity, while availability i...