PT-2026-76563

Name of the Vulnerable Software and Affected Versions compliance-trestle versions prior to 4.0.4 Description An incomplete allowlist in the URLSecurityValidator within trestle/core/remote/security.py allows Server-Side Request Forgery SSRF via the HTTPSFetcher and SFTPFetcher remote-fetch paths...

CVE-2026-73247

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...

CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...

CVE-2026-73247

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...

CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...

CVE-2026-73247 Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...

CVE-2026-73247

Kestra prior to 2.0.0 has a SSRF-like issue in HttpFunction.java: the user-controlled http() URI is passed to URI.create() and used by the server-side HTTP client without restricting private, loopback, or link-local destinations. This allows an unauthenticated attacker to import and execute a flo...

CVE-2026-73080

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volumegrpcremote.go fetches a caller-supplied remote endpoint through weed/remotestorage/s3/s3storageclient.go and writes the response into a needle. The RPC performs no authentication and no...

GHSA-87FV-VQQR-M4JR SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Impact VolumeServer.FetchAndWriteNeedle fetches a caller-supplied remote endpoint and writes the response into a needle. Before 4.24 this RPC performed no authentication and no validation of the target, so anyone able to reach a volume server's gRPC port could coerce the server into issuing...

CVE-2026-73080 SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volumegrpcremote.go fetches a caller-supplied remote endpoint through weed/remotestorage/s3/s3storageclient.go and writes the response into a needle. The RPC performs no authentication and no...

CVE-2026-73080 SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volumegrpcremote.go fetches a caller-supplied remote endpoint through weed/remotestorage/s3/s3storageclient.go and writes the response into a needle. The RPC performs no authentication and no...

CVE-2026-73080 SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volumegrpcremote.go fetches a caller-supplied remote endpoint through weed/remotestorage/s3/s3storageclient.go and writes the response into a needle. The RPC performs no authentication and no...

CVE-2026-72560

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...

CVE-2026-72552

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72606

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72606

Pinry (through version 2.1.13) is affected by a Server-Side Request Forgery (SSRF). The vulnerability arises in the pin-from-URL feature: it passes user-supplied URLs directly to requests.get() without host/IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true, enabling anonymous triggering...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

EUVD-2026-56045

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...