CVE-2026-81357

CVE-2026-81357 is a server-side request forgery (SSRF) vulnerability in Visual Studio Code that allows an unauthorized attacker to bypass a security feature over a network . The vulnerability requires user interaction but no prior privileges, and has a CVSS 3.1 score of 8.2 (HIGH) with high confi...

EUVD-2026-73159

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

EUVD-2026-65228

NLTK: pathsec SSRF protection can be bypassed when a proxy is configured...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

EUVD-2026-72807

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

Visual Studio Code Security Feature Bypass Vulnerability

Server-side request forgery ssrf in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Skype for Business Information Disclosure Vulnerability

Server-side request forgery ssrf in Skype for Business allows an unauthorized attacker to disclose information over a network...

CVE-2026-73315 XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...

EUVD-2026-72786

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...

CVE-2026-73315 XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...

CVE-2026-47884

A flaw was found in the XsltView component of Spring MVC applications. This vulnerability could allow a remote, unauthenticated attacker to perform Server-Side Request Forgery SSRF, enabling them to make unauthorized requests from the server, and potentially achieve Remote Code Execution RCE,...

CVE-2026-86590

In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery SSRF to read response...

CVE-2026-86590

In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery SSRF to read response...

CVE-2026-86590

Eclipse Che versions 7.79.0 through 7.121.0 contain a server-side request forgery (SSRF) in the dashboard backend's POST /dashboard/api/data/resolver endpoint. The endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering, and the operator-configured al...

CVE-2026-81806

Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...

CVE-2026-81806

CVE-2026-81806 is a Server-Side Request Forgery (SSRF) vulnerability in the WordPress Hide My WP Ghost plugin, affecting versions from unspecified through 7.0.09 . The flaw, disclosed by Patchstack , allows an unauthenticated, remote attacker (no user interaction required) to forge server-side re...

CVE-2026-81806 WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...

CVE-2026-76971

Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...

CVE-2026-76971 Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence

Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...

CVE-2026-76971 Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence

Due to a Server-Side Request Forgery SSRF vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arbitrary outbound requests. If processed by the application, this behavior could be combined with XML/XSL processing to enable execution of...