CVE-2026-85691

MegaParse 0.0.55 contains an unauthenticated server-side request forgery (SSRF) in the POST /v1/url endpoint, which fetches caller-supplied URLs server-side without requiring authentication. Attackers can supply internal service URLs or cloud metadata endpoints and read their responses directly f...

CVE-2026-85675

OWL 's DocumentProcessingToolkit contains a server-side request forgery (SSRF) vulnerability in the extract_document_content tool. The tool fetches caller-supplied URLs without scheme, host, or IP filtering , allowing attackers to inject malicious URLs via prompt injection and cause the server to...

CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-85667

xiaobei through 5.5.2 fails to implement authentication or signature validation on its webhook endpoints, specifically the /webhook_worktool handler. This allows unauthenticated network attackers to inject arbitrary messages into the agent pipeline and exploit unvalidated media URL fetching to pe...

CVE-2026-85666 ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url

OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...

CVE-2026-85666 ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url

OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...

EUVD-2026-71122

OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...

CVE-2026-85666

OGX (formerly Llama Stack), affected at commit fbe8e0f and released as v1.3.1 , contains an unauthenticated server-side request forgery (SSRF) in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter along with headers and authorization values that ...

CVE-2026-85666 ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url

OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...

CVE-2026-85662 Marqo 2.26.0 Server-Side Request Forgery via Media URLs

Marqo 2.26.0 contains a server-side request forgery vulnerability in the adddocuments endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit downloadimagefromurl and fetchcontentsample functions which...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-85650

Trigger.dev versions before 4.5.2 contain a server-side request forgery (SSRF) vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal servi...

CVE-2026-85608

Douyin_TikTok_Download_API (through version 4.1.2 ) is vulnerable to server-side request forgery (SSRF) in the /api/download and /api/hybrid/video_data endpoints. An unauthenticated attacker can supply an arbitrary url query parameter to make the server fetch internal resources, including cloud m...

EUVD-2026-71224

DouyinTikTokDownloadAPI through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/videodata endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services including...

CVE-2026-85614 OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue request...

EUVD-2026-71033

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue request...

CVE-2026-85612

OpenPanel before 2.3.0 contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /misc/favicon and /misc/og endpoints. These endpoints accept an attacker-supplied url parameter with insufficient validation, allowing an attacker to force the API to fetch arbitrary interna...

CVE-2026-85612 OpenPanel before 2.3.0 SSRF via favicon and og endpoints

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

CVE-2026-80181

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-80181 Apache Allura: Server-side request forgery

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...