CVE-2026-54166

Shelf , a physical asset tracking platform, contains a Server-Side Request Forgery (SSRF) in its Asset CSV Content Import feature prior to version 1.20.3 . Authenticated users with the asset:import permission can bypass imageUrl validation using image-extension suffixes, path keywords, domain sub...

CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to server-side request forgery due to axios ( CVE-2025-62718 )

Summary Potential vulnerabilities in axios package CVE-2025-62718 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not...

Exploit for CVE-2026-85612

CVE-2026-85612 CVE-2026-85612https://vulners.com/cve/CVE-20...

CVE-2026-19486 SSRF in Gemini Enterprise Agent Platform App Builder

A Server-Side Request Forgery SSRF vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Platform allows an unauthenticated attacker to leak the Compute Engine default service account access token. This vulnerability was patched on...

PT-2026-89845

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the json decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php ...

CVE-2026-54054

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0 , its URL import endpoint (POST /api/files/url) is vulnerable to full-read SSRF . The HTTP downloader fetches user-supplied URLs with redirects enabled and does not validate whether the targ...

CVE-2026-81213 Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

CVE-2026-82097 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery SSRF vulnerability...

CVE-2026-9667

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to server-side request forgery (SSRF) (CWE-918), allowing a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints. The impact is limited to low confidentiality per the CVSS 3.1 score of 5.3...

CVE-2026-89049

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-88056

Angular's @angular/platform-server is vulnerable to SSRF and cross-origin credential disclosure prior to versions 20.3.30, 21.2.22, and 22.1.4 . The root cause is that the resolveUrl and parseUrl utilities invoked String.prototype.trim(), which strips leading Unicode whitespace (e.g. U+00A0, U+FE...

CVE-2026-88056 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader

Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...

GHSA-34R3-9M95-VQ73 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...

CVE-2026-88892

OpenPanel is an analytics platform. In all versions no patched release available at time of publication, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard apps/api/src/utils/safe-fetch.ts. In packages/importer/src/providers/umami.ts,...