Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery in Dynamic Client Registration

Summary IBM ContextForge MCP Gateway includes a Dynamic Client Registration DCR feature that automatically discovers and registers OAuth 2.0 clients by fetching authorization server metadata. The registrationendpoint URL obtained from that metadata is posted to without being passed through the...

EUVD-2026-102477

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

CVE-2026-111313 JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

CVE-2026-111313

The JobOps software (versions through 0.13.1 ) is vulnerable to a Server-Side Request Forgery (SSRF) in the POST /api/manual-jobs/fetch handler. This flaw allows authenticated users or unauthenticated clients in demo mode to force the server to fetch internal destinations by supplying loopback, p...

CVE-2026-111313 JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

CVE-2026-111313

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

ChaskiqHQ Chaskiq Server Request Forgery Vulnerability

ChaskiqHQ Chaskiq 2.0.3 and earlier versions have a server-side request forgeing vulnerability. This vulnerability arises from a flaw in server-side request handling. Unauthenticated attackers can submit internal URLs including cloud instance metadata endpoints through the createUrlUpload GraphQL...

PT-2026-115277

Name of the Vulnerable Software and Affected Versions JobOps versions prior to 0.13.2 Description A server-side request forgery SSRF issue exists in the 'POST /api/manual-jobs/fetch' endpoint. This allows authenticated users, or unauthenticated clients when the system is in demo mode, to force th...

CVE-2026-111313: Server-Side Request Forgery (SSRF)

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

CVE-2026-110868

Renovate versions before 44.79.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The issue allows users to force the shared HTTP client to request arbitrary internal URLs through extends presets or customDatasources . An attacker can exploit this by pointing a preset at an i...

CVE-2026-110868 Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

DaKheera47 JobOps server-side request forgeing vulnerability

DaKheera47 JobOps 0.13.1 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from the POST /api/manual-jobs/fetch handler, which allows for server-side request forgeing. Attackers can provide loopback, private, or cloud metadata addresses in the URL...

CVE-2026-110628 Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

CVE-2026-110628

Versions 0.5.5 through 0.6.0 of Kan are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . This vulnerability exists in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255 . If the S3_ENDPOINT environment variable is unset, an attacker can provide ar...

EUVD-2026-101256

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

CVE-2026-110628

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

CVE-2026-110628 Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

PT-2026-114070

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3 ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services,...

CVE-2026-110628: Server-Side Request Forgery (SSRF)

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch to read internal services, localho...

CVE-2026-57143

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxngsearch and the searchweb SearxNG provider pass the LLM-controlled searxngurl parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the...