CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93597 ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

WordPress Generate PDF using Contact Form 7 plugin < 4.2.2 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Artus KG in WordPress Plugin Generate PDF using Contact Form 7 versions 4.2.2...

CVE-2026-85180

A flaw was found in Ollama. This vulnerability, known as Server-Side Request Forgery SSRF, occurs because Ollama fails to validate redirect destinations when pulling tensor-layer models. An unauthenticated attacker can exploit this by controlling a registry and serving a malicious tensor-layer...

CVE-2026-40537

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

BIT-KYVERNO-2025-15613 Kyverno before v1.13.4 SSRF via Service Call

Kyverno before v1.13.4 is vulnerable to server-side request forgery SSRF via its Service Call functionality. An attacker with permission to create Kyverno ClusterPolicies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster...

CVE-2026-40537

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40537

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

EUVD-2026-82791

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40537

A server-side request forgery (SSRF) vulnerability exists in the PersonMail API component of Synology DiskStation Manager (DSM) prior to versions 7.2.1-69057-10 , 7.2.2-72806-7 , and 7.3.2-86009-2 . A remote authenticated user can leverage this flaw to obtain non-sensitive information . The vulne...

CVE-2026-67101

HCL BigFix Service Management is affected by a Server-Side Request Forgery SSRF vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet...

CVE-2026-67101

HCL BigFix Service Management is vulnerable to a Server-Side Request Forgery (SSRF) flaw in its search functionality . An attacker can exploit this to force the application server to send requests to internal systems that are otherwise inaccessible from the internet, with high confidentiality and...

CVE-2026-67101 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Server-Side Request Forgery SSRF vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet...

CVE-2026-67101 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Server-Side Request Forgery SSRF vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet...

EUVD-2026-82765

HCL BigFix Service Management is affected by a Server-Side Request Forgery SSRF vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet...

CVE-2026-12106

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106 Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

EUVD-2026-82730

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106 Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

CVE-2026-12106

The Auto Upload Images plugin for WordPress (all versions up to and including 3.3.2 ) is vulnerable to a Limited Server-Side Request Forgery (SSRF) via the downloadImage function. The root cause is the use of wp_remote_get() instead of wp_safe_remote_get(), combined with a validate() method that ...