CVE-2026-59973: Server-Side Request Forgery (SSRF)

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec forwards untrusted OpenAPI url and spec inputs and...

CVE-2026-58201: Server-Side Request Forgery (SSRF)

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-91935: Server-Side Request Forgery (SSRF)

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

PT-2026-92055

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

CVE-2026-58196: Server-Side Request Forgery (SSRF)

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol MCP servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP...

PT-2026-91928

Name of the Vulnerable Software and Affected Versions KubeSphere versions prior to 4.1.4 Description An issue exists in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can provide arbitrary URLs to acce...

PT-2026-92085

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description An unauthenticated server-side request forgery SSRF issue exists in the check site availability function. This occurs because the function accepts attacker-controlled HTTP Host headers. By sending...

CVE-2026-61559: Server-Side Request Forgery (SSRF)

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable ENABLEDYNAMICAPIURL=true is set, the server reads the X-GitLab-API-URL HTTP request header and uses it as the base URL for all outbound GitLab A...

PT-2026-92440

Name of the Vulnerable Software and Affected Versions EdgeConnect SD-WAN Orchestrator affected versions not specified Description An issue in the API allows a remote attacker with low privileges to perform server-side request forgery SSRF, a technique where the attacker induces the server to make...

CVE-2026-79425

An authenticated Server-Side Request Forgery SSRF in the /adminapi/file/onlineupload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request...

PT-2026-92125

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API por...

PT-2026-92062

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where get pdf path re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to acce...

CVE-2026-55591: Server-Side Request Forgery (SSRF)

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

CVE-2026-54544: Server-Side Request Forgery (SSRF)

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @loginrequired decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare...

CVE-2026-53957: Server-Side Request Forgery (SSRF)

Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, exportspace and importspace in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and...

CVE-2026-58485: Server-Side Request Forgery (SSRF)

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

CVE-2026-54688: Server-Side Request Forgery (SSRF)

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

CVE-2026-48737: Server-Side Request Forgery (SSRF)

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, isglobaladdress in src/pyload/core/utils/web/check.py relies on Python's global-address classification without examining IPv4 destinations embedded in 6to4 or NAT64 IPv6 addresses. A low-privileged user...

PT-2026-93114

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @login required decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare...

CVE-2026-54689: Exposure of Sensitive Information to an Unauthorized Actor

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...