EUVD-2026-43581

A weakness has been identified in mosaxiv clawlet up to 0.2.10. The impacted element is the function webfetch of the file tools/toolwebfetch.go of the component IPv4 Handler. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploi...

CVE-2026-15619 mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery

A weakness has been identified in mosaxiv clawlet up to 0.2.10. The impacted element is the function webfetch of the file tools/toolwebfetch.go of the component IPv4 Handler. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploi...

PT-2026-58705

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager affected versions not specified Description Adobe Experience Manager contains a Server-Side Request Forgery SSRF flaw, which occurs when a server is tricked into making requests to an unintended location. This issue...

PT-2026-58747

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions, where a network-accessible attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to denial of service and information disclosure...

PT-2026-57952

A vulnerability has been found in nextlevelbuilder GoClaw 3.13.3-beta.3. Affected by this vulnerability is the function bytePlusDownloadVideo of the file internal/tools/create video byteplus.go of the component invoke Endpoint. The manipulation of the argument output.video url leads to server-sid...

PT-2026-58292

Name of the Vulnerable Software and Affected Versions SonicWall SMA 1000 series affected versions not specified Description An improper control of code generation issue exists in the Appliance Management Console AMC. This flaw allows a remote authenticated attacker with administrator privileges t...

PT-2026-58822

ColdFusion is affected by a Server-Side Request Forgery SSRF vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user...

CVE-2026-46644: Improper Validation of Unsafe Equivalence in Input

Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process does not enforce the UTS 46...

PT-2026-58291

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 affected versions not specified sonicwall sma6210 firmware versions 12.4.3-03245 through 12.5.0-02624 sonicwall sma7210 firmware affected versions not specified sonicwall sma8200v affected versions not specified Description A...

Incus SSRF

The vulnerability of the server daemon incus in the container management and virtual machine manager system is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack...

PT-2026-58099

Nexus Repository 3 is vulnerable to Server-Side Request Forgery SSRF via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects...

PT-2026-85353

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal...

PT-2026-60102

Name of the Vulnerable Software and Affected Versions Anyquery affected versions not specified Description When operating in server mode, the software does not restrict outbound HTTP requests initiated by built-in SQLite virtual table modules, such as json reader and log reader. Unauthenticated...

PT-2026-58100

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 affected versions not specified Description Nexus Repository 3 fails to validate the destination URL configured in the "Webhook: Global" capability before initiating outbound HTTP requests. This allows a user with Capability...

PT-2026-57959

A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...

VulnCheck KEV: CVE-2026-15409

SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location...

CVE-2026-48259: Server-Side Request Forgery (SSRF)

Adobe Experience Manager is affected by a Server-Side Request Forgery SSRF vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could leverage this vulnerability to issue unauthorized server-side requests, potentially gaining...

PT-2026-60113

Name of the Vulnerable Software and Affected Versions nebula-mesh affected versions not specified Description Certificate revocation is not enforced within the mesh because the agent fails to process the blocklist provided by the server. While the server correctly computes and ships the per-CA...

PT-2026-57933

A security vulnerability has been detected in mosaxiv clawlet up to 0.2.10. This affects the function tools.webFetch of the file tools/tool web fetch.go. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be...

PT-2026-58827

A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack m...