PT-2026-66638

Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an animation property such as duration can contain a sequence, terminate the generated sty...

PT-2026-61552

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0 Description A server-side request forgery SSRF issue exists in the JWKS fetcher. The system validates the URL hostname string against allow-lists but fails to verify the resolved IP addresses. An attacker with...

PT-2026-61532

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts Server-Side Request Forgery...

PT-2026-61560

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5 Description A server-side request forgery SSRF issue exists in the JWKS fetcher. The system follows HTTP redirects without re-validating the redirect targets against network capabilities. Users with the Owner...

CVE-2026-13147: Undefined Security Weakness

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts Server-Side Request Forgery...

PT-2026-61734

Name of the Vulnerable Software and Affected Versions FlareSolverr versions prior to 3.4.7 Description A server-side request forgery SSRF issue exists in the '/v1' API endpoint. This flaw allows a remote attacker to induce the server to make requests to an unintended location, potentially enablin...

PT-2026-71318

Name of the Vulnerable Software and Affected Versions Astro versions 2.9.0 through 7.0.9 Description The server-side View Transition CSS generator interpolates animation properties into an inline style element without proper escaping for CSS and HTML contexts. An attacker can provide a malicious...

PT-2026-61809

Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.0.6 Description A cross-site scripting XSS issue exists when the software is used with an SSR runtime that exposes a global HTMLElement such as Deno, Bun with a DOM shim, or jsdom/happy-dom in Node and a class extendi...

ColdFusion Security Bypass

The vulnerability of the ColdFusion software platform is related to insufficient testing of queries on the server side. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...

Microsoft .NET SSRF

The vulnerability of the Microsoft .NET software platform is related to incorrect encoding or escaping of output data. Exploiting this vulnerability can allow a malicious actor to execute an SSRF attack remotely...

Content Credentials SDK Insufficient Validation Privilege Escalation

The vulnerability of the Content Credentials SDK libraries is related to insufficient validation of requests at the server side. Exploiting this vulnerability can allow attackers to enhance their privileges...

camel-solr SSRF Unauthorized Access

The vulnerability of the camel-solr component of the Apache Camel Java framework is related to incorrect elimination of certain elements in the output data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential information or perform a SSRF attack...

PT-2026-61689

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficie...

PT-2026-61594

Name of the Vulnerable Software and Affected Versions Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System versions prior to dd1a9df64 Description An issue exists where server-side security is enforced on the client side, which allows for...

CVE-2026-51031

FlareSolverr before version 3.4.7 contains a server-side request forgery SSRF vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information...

PT-2026-61692

Name of the Vulnerable Software and Affected Versions Huginn versions prior to 2022.08.19 Description Authenticated users can perform server-side request forgery SSRF by submitting crafted URLs. This issue occurs within the fetch url function of the ScenarioImport class, allowing attackers to mak...

CVE-2026-51031

FlareSolverr before version 3.4.7 contains a server-side request forgery SSRF vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information...

PT-2026-61680

The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses...

CVE-2026-51031

FlareSolverr versions prior to 3.4.7 are vulnerable to a Server-Side Request Forgery (SSRF) flaw in the /v1 API endpoint. This vulnerability allows a remote attacker to induce the server to make requests to unintended locations, potentially resulting in the retrieval of sensitive information . A ...

PT-2026-61687

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 6.x through 6.17.10 LimeSurvey versions 7.x through 7.0.4 Description Authenticated users can trigger a server-side request forgery SSRF by providing a manipulated Host header. This occurs due to the unsanitized use of the...