CVE-2026-100705

Kyverno versions before 1.19.1 are vulnerable to server-side request forgery (SSRF) due to a lack of egress filtering and URL validation in the legacy apiCall service executor (pkg/engine/apicall/executor.go) and the GlobalContextEntry external-API path. While new CEL libraries include a default ...

CVE-2026-100705 Kyverno before 1.19.1 SSRF via legacy apiCall service executor

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

CVE-2026-100705 Kyverno before 1.19.1 SSRF via legacy apiCall service executor

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

CVE-2026-100705 Kyverno before 1.19.1 SSRF via legacy apiCall service executor

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

EUVD-2026-87678

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

CVE-2026-100391

MediaFlow Proxy versions through 2.4.9 are vulnerable to a server-side request forgery (SSRF) in the /proxy routes. The root cause is missing and incomplete destination validation in the d query parameter. This allows remote attackers to supply arbitrary internal URLs, including loopback addresse...

CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

EUVD-2026-87316

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-100373 OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

PT-2026-99101

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.3 Description An issue exists in the URLValidator.validateURL function where DNS hostnames are not properly resolved and internal addresses are not correctly validated. This allows users with permissions to...

CVE-2026-100391: Server-Side Request Forgery (SSRF)

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100373: Server-Side Request Forgery (SSRF)

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-77294

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...

CVE-2026-77294 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...

CVE-2026-77294 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...

CVE-2026-77294 TREK: Server-Side Request Forgery via User-Configurable LLM Base URL

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...

CVE-2026-77294

The collaborative travel planner TREK is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 3.3.0 . When the LLM_PARSING feature is enabled, an authenticated user with write permissions to a trip instance can store an attacker-controlled llm_base_url via the settings API. The...

EUVD-2026-86338

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llmbaseurl through the settings API when the LLMPARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted impo...