CVE-2026-93506

SveltyCMS 0.0.6 is affected by a server-side request forgery (SSRF) vulnerability in the File Upload Endpoint at /mediagallery/upload-media. The root cause is described as "unknown processing" within that component. A remote, authenticated attacker (low privileges required) can exploit this with ...

CVE-2026-93506 SveltyCMS File Upload Endpoint upload-media server-side request forgery

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

EUVD-2026-82980

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

CVE-2026-93506 SveltyCMS File Upload Endpoint upload-media server-side request forgery

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

CVE-2026-93597

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-62282

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests ...

CVE-2026-75885

A flaw was found in the OpenShift console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery SSRF, where the console pod makes requests to internal services and...

CVE-2026-62282

OpenCVE , a vulnerability intelligence platform, is affected by a Server-Side Request Forgery (SSRF) in its notification testing feature for Webhook and Slack integrations . Prior to 3.0.0 , user-supplied HTTP/HTTPS destinations are not sufficiently validated, allowing an authenticated user with ...

CVE-2026-62282 OpenCVE: Server-Side Request Forgery (SSRF) in notifications

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests ...

CVE-2026-62282 OpenCVE: Server-Side Request Forgery (SSRF) in notifications

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests ...

CVE-2026-62282 OpenCVE: Server-Side Request Forgery (SSRF) in notifications

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests ...

CVE-2026-93597

ArcadeDB versions before 26.9.1 contain a Server-Side Request Forgery (SSRF) vulnerability in the SSRF guard used by the IMPORT DATABASE and server commands. The root cause is a failure to validate IPv6 transition addresses (NAT64, 6to4, or Teredo), allowing an authenticated attacker to supply UR...

EUVD-2026-82892

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

WordPress Generate PDF using Contact Form 7 plugin < 4.2.2 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Artus KG in WordPress Plugin Generate PDF using Contact Form 7 versions 4.2.2...

CVE-2026-85180

A flaw was found in Ollama. This vulnerability, known as Server-Side Request Forgery SSRF, occurs because Ollama fails to validate redirect destinations when pulling tensor-layer models. An unauthenticated attacker can exploit this by controlling a registry and serving a malicious tensor-layer...

CVE-2026-40537

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

BIT-KYVERNO-2025-15613 Kyverno before v1.13.4 SSRF via Service Call

Kyverno before v1.13.4 is vulnerable to server-side request forgery SSRF via its Service Call functionality. An attacker with permission to create Kyverno ClusterPolicies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster...