PT-2026-104071

Name of the Vulnerable Software and Affected Versions mcp-server-fetch versions prior to 2026.6.4 mcp-server-everything versions prior to 2026.6.4 Description A server-side request forgery SSRF issue exists in the Fetch Tool component. The vulnerability occurs within the fetch url function locate...

PT-2026-104280

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7 Description A server-side request forgery SSRF issue exists in the Bazar valeur action. Page editors can force the server to fetch arbitrary URLs by manipulating the url parameter. By embedding this action with ...

PT-2026-104317

Server-Side Request Forgery SSRF vulnerability in ThemeREX Group ThemeREX Addons trx addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0...

CVE-2026-102797: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0...

OpenStack Swift vulnerable to authenticated server-side request forgery

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to...

PYSEC-2026-4173 OpenStack Swift vulnerable to authenticated server-side request forgery

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to...

fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding

A flaw was found in fast-uri, a URI parser for Node.js. The component incorrectly decodes percent escapes in a hostname twice during URI parsing and authority recomposition. This double decoding can allow a remote attacker to manipulate a URI to point to a different network destination, such as a...

CVE-2026-103291

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...

CVE-2026-103082

Server-Side Request Forgery SSRF vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2...

EUVD-2026-90684

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...

CVE-2026-103287 Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...

EUVD-2026-90747

Server-Side Request Forgery SSRF vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2...

CVE-2026-103542

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

EUVD-2026-90502

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103542

A server-side request forgery (SSRF) vulnerability exists in formtools.org Form Tools versions up to 3.1.1 . The flaw is located in the AJAX Endpoint component, specifically within the smart_fill function of the /global/code/actions.php file. This vulnerability is triggered by the manipulation of...

CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

Chromium CVE-2026-87595: Server-side request forgery in Mobile

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-103823

Name of the Vulnerable Software and Affected Versions Ghost versions 3.20.2 through 6.50.9 Description An issue exists in image dimension refetching that allows authenticated staff users to perform Server-Side Request Forgery SSRF. SSRF is a flaw where an attacker can induce the server to make...