EUVD-2026-62366

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

CVE-2026-76164

CVE-2026-76164 is a non-blind SSRF in the AIL Framework crawler submission functionality. A low-privileged authenticated user can submit arbitrary URLs for crawling without adequate destination validation. Manual crawler tasks bypass the existing domain blacklist (assigned non-zero priority), and...

CVE-2026-17565

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...

CVE-2026-17565

The Animation Addons for Elementor WordPress plugin before 2.7.2 is vulnerable to unauthenticated Server-Side Request Forgery (SSRF). An attacker supplies a value used to build the host of a server-side HTTP request, enabling the site to issue requests to internal hosts and return responses. CVSS...

PT-2026-78420

Name of the Vulnerable Software and Affected Versions Stigmem versions prior to 0.9.0a11 Description Authenticated users can perform blind Server-Side Request Forgery SSRF attacks by specifying internal loopback or private network destinations in the delivery address parameter during the creation...

PT-2026-78495

A vulnerability in Cisco Packaged Contact Center Enterprise Packaged CCE and Cisco Unified Contact Center Enterprise Unified CCE could allow an authenticated, remote attacker to conduct server-side request forgery SSRF attacks through an affected device. This vulnerability is due to improper inpu...

MLflow Server-Side Request Forgery Vulnerability

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive responsestatus and responsebody...

PT-2026-78774

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway...

PT-2026-78816

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description A user with the get talos enrichment capability can send a crafted request to the Talos intelligence enrichment REST API endpoint, forcing the instance ...

PT-2026-78479

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description An Improper Restriction of XML External Entity Reference exists, which allows a low privileged attacker with local access to potentially achieve elevation of privileges and Server-sid...

PT-2026-78788

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Administrator role can perform Server-Side Request Forgery SSRF—a technique where an attacker forces a server to make requests to an unintended location—via the...

GHSA-V5RC-CPWC-CFPR Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP, bypassing allowlist

Summary The fix for GHSA-v2wp-frmc-5q3v added validateacmeurl to reject acmeurl values not in ACMEDIRECTORYHOSTALLOWLIST, but the validation is only called at authority creation time POST. The authority update endpoint PUT /api/1/authorities/ accepts and stores arbitrary options -- including a...

GHSA-F3QQ-49M6-RW8F Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95)

Summary The SSRF mitigation added for GHSA-54vg-pfh7-jq95 validaterevocationurl in lemur /certificates/verify.py can be bypassed. An operator-role user who uploads a certificate with attacker-controlled CRL/OCSP extensions can still make Lemur reach internal destinations RFC1918, loopback,...

CVE-2026-70666

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

CVE-2026-65985

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...

CVE-2026-47719

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the DEVICEWEBAPIREQUEST and DEVICEPROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote...

CVE-2026-65985 FUXA: SSRF hardening for `device-webapi-request`

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...

CVE-2026-65985 FUXA: SSRF hardening for `device-webapi-request`

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...

CVE-2026-65985

In FUXA versions 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js lets an authenticated non-admin runtime user control property.address, turning the server into a read SSRF oracle against internal services or cloud metadata endpoints. Exploitation is not r...

CVE-2026-47719

FUXA SCADA/HMI software (versions before 1.3.2) exposes unauthenticated Socket.IO handlers DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY that accept attacker-controlled URLs and credentials, turning the server into a read-SSRF oracle capable of exfiltrating cloud metadata, internal services, OPC UA d...