CVE-2026-14939

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed in the...

EUVD-2026-52588

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

CVE-2026-14939

The Visualizer WordPress plugin (versions before 4.0.6 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to restrict user-supplied URLs to safe address ranges before fetching them server-side, specifically during a JSON Import operation. Users with...

CVE-2026-14939

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

CVE-2026-10526 EmbedPress < 4.6.1 - Unauthenticated Blind SSRF

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

CVE-2026-10526

The EmbedPress WordPress plugin, in versions prior to 4.6.1 , is vulnerable to an unauthenticated blind Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows an...

EUVD-2026-52580

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...

CVE-2026-16536

The Simple Google Calendar Outlook Events Widget WordPress plugin (versions before 3.1.0 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause is a failure to validate user-supplied URLs before performing a server-side request, specifically via the calendar_id ...

CVE-2026-16536 Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...

CVE-2026-16536

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...

CVE-2026-66325

Server-side request forgery ssrf in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

PT-2026-67644

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

PT-2026-67651

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

CVE-2026-66325

Server-side request forgery ssrf in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-48331 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-18647

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

EUVD-2026-52435

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

CVE-2026-18647

The CVE concerns jina-ai reader (up to 1574bfd3…) with a flaw in isValidTLD in the Crawler/Puppeteer component (file backend/functions/src/cloud-functions/crawler.ts) that enables server-side request forgery. Remote exploitation is possible and the exploit has been publicly disclosed. Description...

CVE-2026-18647 jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...