CVE-2026-18424

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

EUVD-2026-79503

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

CVE-2026-76680

CVE-2026-76680 affects the API of EdgeConnect SD-WAN Orchestrator (HPE). The vulnerability is an authenticated Server-Side Request Forgery (SSRF) that allows a remote attacker with low privileges to forge requests to the internal structure of the Orchestrator host. A successful exploit enables en...

CVE-2026-19504

Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...

EUVD-2026-79181

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

verify-ghsa-c4j6-fc7j-m34r

verify-ghsa-c4j6-fc7j-m34r In-band verifier for GHSA-c4j6-fc7j-m34r / CVE-2026-44578 — Server-Side Request Forgery in Next.js via WebSocket upgrade requests. ⚠️ For authorized security testing only. You are responsible for ensuring you have permission to test every target you pass to this script...

CVE-2026-54549

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, the uploadadimage tool in metaadsmcp/core/ads.py passes an attacker-controlled imageurl to trymultipledownloadmethods in metaadsmcp/core/utils.py, where httpx.AsyncClient uses...

CVE-2026-54549

meta-ads-mcp (a Model Context Protocol server for Meta Ads) contains a Server-Side Request Forgery (SSRF) in the upload_ad_image tool. Prior to v1.0.115 , an attacker-controlled image_url parameter is passed to httpx.AsyncClient with follow_redirects=True and no scheme, host, or IP validation , e...

CVE-2026-55864 GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WMS server URL and performed a server-side HTTP GET without destination validation. An anonymous attacker could make the GeoNetwork server...

CVE-2026-91938 Flowise before 3.1.4 Server-Side Request Forgery via document loaders

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...

EUVD-2026-78793

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

CVE-2026-91199

Refly (versions through 1.1.0) is affected by a server-side request forgery (SSRF) vulnerability in the POST /v1/misc/scrape endpoint. The endpoint fetches caller-supplied URLs without validating the scheme, host, or resolved address, allowing authenticated attackers to make the backend issue req...

CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-13275 IBM MQ Managed File Transfer is vulnerable to XML external entity injection

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform...

CVE-2026-13275

IBM MQ Managed File Transfer is vulnerable to XML External Entity (XXE) injection in reply message processing (CWE-611). An authenticated attacker can exploit this to read arbitrary files or perform server-side request forgery (SSRF) . Affected versions span 9.1 LTS (≤9.1.0.37), 9.2 LTS (≤9.2.0.4...

EUVD-2026-78086

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-90814

A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of...

CVE-2026-90818

CVE-2026-90818 affects netease-youdao LobsterAI (versions 2026.6.15, 2026.8.28, 2026.9.3, and 2026.9.4). The vulnerability is a Server-Side Request Forgery (SSRF) in the Browser Network Configuration component, specifically in the function OpenClawConfigSync.buildBrowserConfig within src/main/lib...

CVE-2026-90818 netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in...