EUVD-2026-125237

NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NCALLOWLOCALHOOKS or NCWEBHOOKALLOWPRIVATENETWORK is set, attackers can request...

CVE-2026-126284

NocoDB versions 2026.05.2 before 2026.07.0 are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is that the data import functionality incorrectly reused the webhook internal-network exemption. When the configurations NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK are ...

Exploit for Server-Side Request Forgery in Langchain

CVE-2023-46229: LangChain SitemapLoader SSRF CVE-2023-46229 l...

Exploit for CVE-2026-56712

CVE-2026-56712: Cog cog.types.File.validate or cog.types.P...

EUVD-2026-115906

Label Studio before 1.23.2 label-studio-sdk before 2.1.2 contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COC...

EUVD-2026-101751

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110868

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110868 Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110868 Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110718 TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download

TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...

CVE-2026-110718

The TurboDocx html-to-docx library (versions through 1.23.1 ) is vulnerable to a Server-Side Request Forgery (SSRF) . An attacker providing malicious HTML can force the server to fetch internal URLs using the img src attribute. This is possible because the isValidUrl() check is too loose, allowin...

PT-2026-114120

TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...

CVE-2026-110718: Server-Side Request Forgery (SSRF)

TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl...

CVE-2026-104976

The project management tool Plane is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 1.4.0 . The application fails to reject hosts that resolve to private or internal IP addresses when validating the GITEA_HOST variable. Specifically, four outbound requests in the Gitea OA...

CVE-2026-102904 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

CVE-2026-100391

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

EUVD-2026-87328

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

PT-2026-99111

Name of the Vulnerable Software and Affected Versions MediaFlow Proxy versions prior to 2.5.0 Description An issue exists in the '/proxy' endpoint where missing and incomplete destination validation of the d query parameter allows for server-side request forgery SSRF. This occurs when a server is...

CVE-2026-85163: Server-Side Request Forgery (SSRF)

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epglink parameter during video upload, which is validated only for syntax and...