CVE-2026-53509

@aborruso/ckan-mcp-server (an MCP server for querying CKAN open data portals) is vulnerable to SSRF prior to version 0.4.106 . The validateServerUrl hostname check in src/utils/http.ts only blocked the literal string localhost, but hostname aliases such as ip6-localhost and ip6-loopback (defined ...

CVE-2026-53509 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

CVE-2026-53509 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

CVE-2026-54457

TensorZero (open-source LLMOps platform) is vulnerable to arbitrary file read and SSRF via its Gateway /internal/object_storage endpoint in versions prior to 2026.6.0 . The endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration...

CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...

Microsoft Exchange Server SSRF Vulnerability

This vulnerability is part of an attack chain that could allow remote code execution on Microsoft Exchange Server. The initial attack requires the ability to make an untrusted connection to Exchange server port 443. Other portions of the chain can be triggered if an attacker already has access or...

CVE-2026-63004

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

NPM: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

NPM: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers vulnerability discovered by ? in WordPress Npm unleash-server versions 7.5.2...

EUVD-2026-64040

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004

Unleash , an open-source feature management platform, is vulnerable to Server-Side Request Forgery (SSRF) in its addon and integration subsystem. The operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations is pass...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

CVE-2026-63004 Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry i...

EUVD-2026-64019

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...

CVE-2026-69502

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-22681

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-22681

OpenViking (by Volcengine) before 0.3.4 is vulnerable to Server-Side Request Forgery (SSRF) via the /api/v1/resources endpoint. An authenticated low-privilege attacker can POST a crafted URL, causing the server to issue outbound HEAD and GET requests with redirects enabled to loopback, RFC 1918, ...

CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server ...

EUVD-2026-63994

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-73212

A flaw was found in Coturn. An authenticated client using the RFC 6062 TCP CONNECT relay path can bypass intended IPv4 denied-peer-ip range restrictions due to improper canonicalization of IPv4-compatible, 6to4, and NAT64 address forms. This vulnerability can lead to Server-Side Request Forgery...