CVE-2026-79914

NocoBase versions 2.1.0 through 2.1.14 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability in the customRequests:send endpoint. A low-privileged authenticated user can exploit this by using options.url to override the stored request URL at runtime. This allows the server to send ...

EUVD-2026-120530

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through...

CVE-2026-125367

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through...

CVE-2026-125367: picosh pico: Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up…

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through...

CVE-2026-125367

Pico versions through 4.1.2 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability within the feeds service . The issue allows signed-up users to force the server to fetch arbitrary URLs by uploading a feeds digest post containing internal URLs. This triggers immediate fetching via...

CVE-2026-125367 Pico through 4.1.2 SSRF in Feeds Service via run SSH Command

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through...

PT-2026-141190

Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through...

CVE-2026-124466

OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwksuri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned...

CVE-2026-124466

OpenEMR versions before 8.4.0 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause is the application's failure to validate the jwks_uri during OAuth2 client registration. An unauthenticated attacker can register a client with a malicious URI and trigger a fetc...

EUVD-2026-119522

OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwksuri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned...

CVE-2026-124466 OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri

OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwksuri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned...

CVE-2026-124466: openemr: OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make…

OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwksuri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned...

EUVD-2026-118326

Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configuration only defining source ACLs without...

CVE-2026-123207

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

CVE-2026-123207 LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

CVE-2026-123207 LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

EUVD-2026-117652

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher

Summary The app store icon code dist/appstore/icon-probe.js around line 200 and icon-bytes.js around line 138 resolves a plugin's declared signalk.appIcon. Relative paths are pinned to the CDN, but an absolute https URL is used as-is: the server fetches it, follows redirects, and stores any image...

CVE-2026-119712

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser.fetchsingleurl that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web...

CVE-2026-119545

A flaw was found in Forgejo. A remote, unauthenticated attacker can conduct Server-Side Request Forgery SSRF by submitting an arbitrary OpenID identifier to the login endpoint. This issue forces the server to send unverified HTTP requests to internal addresses, loopback interfaces, or cloud...