CVE-2026-65466 WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability

Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...

EUVD-2026-48078

Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...

CVE-2026-24639 WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability

Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...

EUVD-2026-48146

Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...

CVE-2026-24639

The CVE-2026-24639 entry concerns the WordPress Photo Block plugin (

Exploit for Server-Side Request Forgery in Lollms

CVE-20...

CVE-2026-64873 Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services...

Server-Side Request Forgery

Spring Boot Admin Server is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied healthUrl and managementUrl parameters during instance registration, allowing unauthenticated attackers to force the server to send HTTP requests to...

PT-2026-63888

Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...

PT-2026-63917

Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...

PT-2026-64169

Name of the Vulnerable Software and Affected Versions Johnson Controls CCure 9000 and victor application server versions 2.9 through 3.0 Description A Server Side Request Forgery SSRF issue exists in the Victor application server. SSRF is a flaw that allows an attacker to induce the server-side...

PT-2026-64207

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

PT-2026-63804

Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...

PT-2026-64095

Server-Side Request Forgery SSRF in upload ad image via Unrestricted image url Fetch Summary The upload ad image MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled image url parameter directly to an HTTP fetch helper httpx.AsyncClientfollow redirects=True.geturl without any scheme,...

PT-2026-63889

Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...

PT-2026-63930

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through createForwardedActionResponse and createRedirectRenderResult in packages/next/src/server/app-render/action-handler.ts. An attacker can make the server send a forwarded...

GHSA-89XV-2M56-2M9X Next.js: Server-Side Request Forgery in Server Actions on custom servers

Impact When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forgery. This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtai...

NPM: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

NPM: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname vulnerability discovered by ? in WordPress Npm next versions = 12.0.0, 15.5.21...

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Impact A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the...