PT-2026-95325

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description A server-side request forgery SSRF issue exists...

EulerOS Virtualization 2.11.1 : python-urllib3 (EulerOS-SA-2026-3468)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all...

EulerOS Virtualization 2.11.1 : python-pip (EulerOS-SA-2026-3464)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third...

EulerOS Virtualization 2.11.0 : python-urllib3 (EulerOS-SA-2026-3555)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all...

PT-2026-95266

Name of the Vulnerable Software and Affected Versions Auto Upload Images versions prior to 3.3.3 Description This issue is a Limited Server-Side Request Forgery SSRF, a flaw that allows a server to be coerced into making requests to an unintended location. Authenticated attackers with...

PT-2026-95717

Name of the Vulnerable Software and Affected Versions OpenShift console affected versions not specified Description Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can result in Server-Side Request...

CVE-2026-67101: Server-Side Request Forgery (SSRF)

HCL BigFix Service Management is affected by a Server-Side Request Forgery SSRF vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet...

CVE-2026-62282: Server-Side Request Forgery (SSRF)

OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests ...

CVE-2026-40537: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability in PersonMail API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-18869: Server-Side Request Forgery (SSRF)

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands...

CVE-2026-76900: Server-Side Request Forgery (SSRF)

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through...

CVE-2026-12106: Server-Side Request Forgery (SSRF)

The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...

Linux Distros Unpatched Vulnerability : CVE-2026-93384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass...

PT-2026-95256

Name of the Vulnerable Software and Affected Versions Generate PDF using Contact Form 7 versions prior to 4.2.2 Description The plugin fails to restrict the destination of image fetches performed by its PDF renderer on submitted form content. This allows unauthenticated users to execute a...

PT-2026-95292

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description The search functionality contains a Server-Side Request Forgery SSRF flaw. This allows an attacker to compel the application server to transmit requests to internal...

PT-2026-95392

Name of the Vulnerable Software and Affected Versions OpenCVE versions prior to 3.0.0 Description Notification testing for Webhook and Slack integrations fails to sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permissions to configure notification...

CVE-2026-90984: Server-Side Request Forgery (SSRF)

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-75885: Server-Side Request Forgery (SSRF)

A flaw was found in the OpenShift console. Unauthenticated access to the /api/devfile/ and /api/devfile/samples/ endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery SSRF, where the console pod makes requests to internal services and...

CVE-2026-93597: Server-Side Request Forgery (SSRF)

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

PT-2026-95418

Name of the Vulnerable Software and Affected Versions SveltyCMS version 0.0.6 Description An issue in the File Upload Endpoint component allows for remote server-side request forgery SSRF, which occurs when a server is tricked into making requests to an unintended location. This is caused by...