CVE-2026-102145

An authenticated administrator can exploit a Server-Side Request Forgery (SSRF) vulnerability in Kiteworks Core caused by CRLF Injection . This flaw allows the server to issue requests to and interact with internal network services that are intended to be unreachable through the web interface. Wh...

CVE-2026-102095 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

EUVD-2026-90377

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

CVE-2026-102095

Kiteworks Email Protection Gateway versions prior to 9.5.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The gateway performs server-side fetches of URLs contained within processed message content without sufficient destination restrictions. A remote, unauthenticated attacker can craft...

CVE-2026-102095 Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

EUVD-2026-90372

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102091 Kiteworks Secure Data Forms server-side request forgery

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102091

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to a Server-Side Request Forgery (SSRF) . This flaw allows an unauthenticated, remote attacker to compel the server to issue arbitrary outbound network requests and read back the responses. Such exploitation could enable the attacker ...

CVE-2026-102091 Kiteworks Secure Data Forms server-side request forgery

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-101883 OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-101883 OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

CVE-2026-101883

The OpenClaw Windows Node versions through 2026.9.4 are vulnerable to a Server-Side Request Forgery (SSRF) flaw within the canvas.present capability. The root cause is that canvas.present allows for the bypass of URL risk evaluations normally enforced by canvas.navigate . An attacker possessing g...

CVE-2026-101883 OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make the node's WebView send requests to...

Kiteworks multiple vulnerabilities

RECOMMENDED PRACTICES Fixed in version 9.5.0 and 9.5.1. 2. DESCRIPTION Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the...

CVE-2026-62308

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-62308

Prior to version 1.30.6 , Tugtainer (a self-hosted app for automating Docker container updates) is vulnerable to an authenticated blind server-side request forgery (SSRF) . The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocol...

CVE-2026-62308 Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-62308 Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...

CVE-2026-62308 Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint

Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/testnotification...