PT-2026-118309

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can...

PT-2026-118321

PIA's token verification verify token in pia/oidc.py fetches the OIDC discovery document of an allowlisted issuer and then follows the jwks uri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that th...

PT-2026-118324

UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted...

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery SSRF vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with...

Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

Plex Media Server contains a server-side request forgery SSRF vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and...

CVE-2026-8355 IBM ContextForge MCP Gateway is affected by server-side request forgery

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery SSRF that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during...

CVE-2026-8355

IBM ContextForge MCP Gateway versions 0.1.0 through 1.0.5 are vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) during OAuth-enabled gateway registration. The root cause is a failure to validate the oauth_config.token_url parameter when using client_credentials authentication. This all...

CVE-2026-112991

The htmltomarkdown expansion module in MISP Modules contains a server-side request forgery SSRF vulnerability in its issafeurl URL validation function. The BLOCKEDRANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the...

CVE-2026-112991 MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()

The htmltomarkdown expansion module in MISP Modules contains a server-side request forgery SSRF vulnerability in its issafeurl URL validation function. The BLOCKEDRANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the...

CVE-2026-112991

The MISP html_to_markdown expansion module is vulnerable to Server-Side Request Forgery (SSRF) due to incomplete IP range blocking in the is_safe_url() validation function. The BLOCKED_RANGES list fails to exclude critical ranges, including 0.0.0.0/8 , 100.64.0.0/10 , ::/128 , fc00::/7 , and fe80...

CVE-2026-112991 MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()

The htmltomarkdown expansion module in MISP Modules contains a server-side request forgery SSRF vulnerability in its issafeurl URL validation function. The BLOCKEDRANGES list used to reject unsafe destination addresses was incomplete, omitting several critical IP address ranges. Specifically, the...

CVE-2026-112299

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side...

CVE-2026-112297

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

CVE-2026-112254

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The...

EUVD-2026-104596

A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of the argument Website can lead to server-side...

EUVD-2026-104594

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

EUVD-2026-104590

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The...

Server-side Request Forgery (SSRF)

Overview Crawl4AI is a 🚀🤖 Crawl4AI: Open-source LLM Friendly Web Crawler & scraper Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the SSLCertificate.fromurl process. An attacker can access internal network resources and obtain SSL certificate information ...

CVE-2026-80344

A flaw was found in Apache Camel's AS2 Applicability Statement 2 component. A remote attacker can trigger Server-Side Request Forgery SSRF by sending a message that specifies an arbitrary destination address for asynchronous delivery receipts. Because the application sends receipts to the...

Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor

Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept PoC went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involve...