CVE-2026-81093 Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...

CVE-2026-81091 mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...

CVE-2026-57170

A flaw was found in compliance-trestle. The custom Jinja2 include tags, mdsectioninclude and mdcleaninclude, incorrectly re-parse the content of included Markdown files as Jinja2 template code in a non-sandboxed environment. This vulnerability, known as Server-Side Template Injection SSTI, allows...

CVE-2026-46439

A flaw was found in compliance-trestle. This Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command, which recursively evaluates rendered templates. An attacker can inject malicious payloads into data fields, such as SSP documents or Lookup Tables, to achieve...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

OPENSUSE-SU-2026:21665-1 Security update for wget

This update for wget fixes the following issues: Security issued fixed: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread...

DEBIAN-CVE-2026-47884

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28...

Hitachi Pentaho Business Analytics Server - Remote Code Execution

Hitachi Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, is susceptible to remote code execution via server-side template injection. Certain web services can set property values which contain Spring templates that are interpreted downstream, thereby...

EUVD-2026-66829

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-81421

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

EUVD-2026-66817

Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...

PT-2026-82662

Name of the Vulnerable Software and Affected Versions litellm versions prior to 1.82.5 Description An issue exists where unauthenticated remote attackers can execute arbitrary OS commands. This occurs due to the use of an unsandboxed jinja2.Environment, which enables Server-Side Template Injectio...

PT-2026-82789

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...

CVE-2026-37004

BerriAI litellm (

PT-2026-82806

A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s fetch page/s fetch pattern of the file src/scrapling fetch mcp/ fetcher.py. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely...

CVE-2026-37004

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

CVE-2026-65956

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2025-62341

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

CVE-2025-62341 HCL Connections is vulnerable to server-side request forgery (SSRF)

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

CVE-2025-62341

HCL Connections contains a server-side request forgery (SSRF) vulnerability that becomes exploitable when an internal server is compromised. In certain scenarios, an attacker can send unauthorized requests, potentially leading to information disclosure or security bypass . The CVSS 3.1 base score...