PT-2026-65893

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.7 Description The standalone flyto-verification service in src/core/verification service.py exposes an unauthenticated POST '/run' endpoint on 0.0.0.0:8344. The service uses a client-supplied callback url for...

OPeNDAP Hyrax is vulnerable to SSRF and Credential Disclosure

Overview A vulnerability has been discovered in the OPeNDAP Hyrax software solution. A remote attacker with the ability to submit crafted requests to an affected Hyrax instance could cause the application to communicate with unauthorized remote systems. Under certain conditions, the vulnerability...

CVE-2026-54690

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details CVEID:CVE-2026-14529 DESCRIPTION: IBM WebSphere Application Server traditional and IBM WebSphere...

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

Summary datamodel-code-generator's anti-SSRF guard validates the resolved IP of a fetch target once and then lets httpx perform its own independent DNS resolution to connect, so the validated address is never pinned. A hostname that resolves to a public IP at validation time and a private IP at...

GHSA-954P-556P-R752 datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

Summary JSON-Schema $ref values pointing at HTTP or HTTPS URLs are silently dereferenced by datamodel-code-generator with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The --allow-remote-refs gate added in 0.56.0 defaults to None, which only emits a...

CVE-2026-54690 datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...

CVE-2026-54690

Summary: CVE-2026-54690 affects the datamodel-code-generator project. In versions 0.9.1 through 0.61.0, the tool silently dereferenced attacker-controlled JSON Schema $ref HTTP/HTTPS URLs via src/datamodel_code_generator/parser/jsonschema.py:_get_ref_body, and the --allow-remote-refs gate could w...

EUVD-2026-50074

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.9.1 until 0.61.0, datamodel-code-generator silently dereferences attacker-controlled JSON Schema $ref HTTP or...

Server-side Request Forgery (SSRF)

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the getbody function when processing URLs provided via the --url argument, as there is no validation of host or IP addresses and redirects are...

CVE-2026-54691 datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-54691

CVE-2026-54691 affects datamodel-code-generator prior to 0.61.0; the http.get_body function in src/datamodel_code_generator/http.py accepts --url targets and redirect chains without host/IP validation, enabling server-side request forgery to loopback, private, link-local, metadata, and other netw...

CVE-2026-4912

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...

EUVD-2026-49990

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...

CVE-2026-4912 Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...

CVE-2026-59931

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-14869

The CVE-2026-14869 entry documents a vulnerability in terraform-mcp-server (pre-1.1.0) where a flaw in the streamable-HTTP transport allows an unauthenticated remote attacker to trigger server-side requests that can redirect the Terraform API calls and the server-side authorization token to an at...

CVE-2026-59931

CVE-2026-59931 (PhpSpreadsheet SSRF via WEBSERVICE domain whitelist bypass) Concrete technical details are present in connected sources: PhpSpreadsheet’s Calculation/Web/Service.php validates the host against a domain whitelist but uses file_get_contents() with a PHP HTTP stream wrapper that foll...

CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-43910

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...