11972 matches found
CVE-2026-86259
OpenMAIC versions before 1.0.1 contain a server-side request forgery (SSRF) vulnerability in non-production builds where URL validation is gated by environment. Unauthenticated attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter, reaching cloud instance met...
CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...
PT-2026-86529
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...
CVE-2026-86242: Improper Control of Generation of Code
Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled the default, governance.authconfig.isenabled=false. The shared-object loader treats an http-prefixed path as a downlo...
Exploit for Server-Side Request Forgery in Redhat Keycloak
No d...
CVE-2026-86119
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
CVE-2026-86122 Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server
Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and cloud metadata endpoints to perform server-side request forgery and enumerate internal network...
CVE-2026-86122
Rowboat through version 0.9.1 is affected by a Server-Side Request Forgery (SSRF) vulnerability caused by insufficient validation of custom MCP server and webhook URLs. Authenticated users can configure these URLs to point at internal services and cloud metadata endpoints , enabling enumeration o...
EUVD-2026-71951
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
CVE-2026-86119 Webstudio through 0.296.0 SSRF via /cgi proxy routes
Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZEORIGIN environment variable is unset. Attackers can supply arbitrary URLs to these endpoints to read cloud instance metadata, acces...
CVE-2026-4361 Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict requests to...
EUVD-2026-71858
The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response...
WordPress Greenshift plugin < 13.2.0 - Contributor+ SSRF vulnerability
Contributor+ SSRF vulnerability discovered by Alireza Kalhor in WordPress Plugin Greenshift versions 13.2.0...
SUSE CVE-2026-78682
NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen and callers nltk.data.load, nltk.downloader.Downloader.index/download when an HTTP proxy is configured. pathsec.urlopen validates the requested hostname locally, but proxy-handler inheritance disables...
CVE-2026-86100
Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...
CVE-2026-52769
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...
PT-2026-86329
The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the et pb set video oembed thumbnail resolution function using wp remote get instead of wp safe remote get to fetch a remote image URL, which does not restrict...
CVE-2026-83543: Server-Side Request Forgery (SSRF)
The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response...
PT-2026-86342
šØ CVE-2026-83543 The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response. š@cveNotify...
EUVD-2026-71801
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...