9187 matches found
CVE-2026-63313
9Router before 0.4.72 is affected by a server-side request forgery (SSRF) in the /v1/web/fetch endpoint. The endpoint accepts a user-supplied url and passes it to an external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa). Validation only checks syntactic correctness via new URL(), wi...
EUVD-2026-48425
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0...
CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
Server-side Request Forgery (SSRF)
Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the webService process. An attacker can access internal services and exfiltrate sensitive da...
Azure AI Search Elevation of Privilege Vulnerability
Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...
Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-48522 DESCRIPTION: PyJWT i...
CVE-2026-65466
Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNSResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security ResearchTarget: https://github.com/MervinPraison/PraisonAIWeakness: CWE-918 Server-Side Request Forgery SSRF.--- SummaryThe SSRF guard...
PYSEC-2026-3531 PraisonAI: SpiderTools redirect-target SSRF protection bypass
SpiderTools redirect-target SSRF protection bypass Summary SpiderTools.scrapepage validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls requests.Session.get without disabling automatic redirects or validating redirect Location...
PraisonAI: SpiderTools redirect-target SSRF protection bypass
SpiderTools redirect-target SSRF protection bypass SummarySpiderTools.scrapepage validates the initial URL and rejects directloopback, private, link-local, metadata, and internal hostnames. It then callsrequests.Session.get without disabling automatic redirects or validatingredirect Location...
CVE-2026-65516 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...
CVE-2026-65516
CVE-2026-65516 - Unauthenticated Server-Side Request Forgery in the WordPress plugin PeproDev Ultimate Invoice
CVE-2026-65496
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
CVE-2026-65496 WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
CVE-2026-65496 WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...
CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...
CVE-2026-65467
CVE-2026-65467 corresponds to a Server Side Request Forgery (SSRF) vulnerability in the WordPress JetEngine plugin, affecting versions up to 3.8.11. The issue is described as SSRF in JetEngine