CVE-2026-103287: Server-Side Request Forgery (SSRF)

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...

Server-Side Request Forgery (SSRF)

jackson-databind is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to InetAddress.getByName resolving attacker-controlled input, which allows an attacker to trigger DNS requests from the server and probe or identify internal hosts...

CVE-2026-77274 MCP Atlassian: SSRF Protection Bypass

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL...

CVE-2026-12106

The Auto Upload Images plugin for WordPress (all versions up to and including 3.3.2 ) is vulnerable to a Limited Server-Side Request Forgery (SSRF) via the downloadImage function. The root cause is the use of wp_remote_get() instead of wp_safe_remote_get(), combined with a validate() method that ...

CVE-2026-59823 LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM Proxy

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place apibase inside the userconfig request body to bypass isrequestbodysafe, which blocks top-level apibase and baseurl but...

CVE-2026-76559 WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

CVE-2026-91967 AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering...

EUVD-2026-78643

AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues getheaders calls guarded only by format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links, triggering...

CVE-2026-91966 AVideo through 29.0 Unauthenticated SSRF via Host Header

AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the checksiteavailability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network host...

PT-2026-92086

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1 Description A blind server-side request forgery exists in the getHeaderContentTypeFromURL function, which performs get headers calls that are only protected by format validation. Authenticated users with canUpload...

EUVD-2026-75442

OpenPanel is an analytics platform. In all versions no patched release available at time of publication, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard apps/api/src/utils/safe-fetch.ts. In packages/importer/src/providers/umami.ts,...

CVE-2026-88892 OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard apps/api/src/utils/safe-fetch.ts. In packages/importer/src/providers/umami.ts, parseRemoteFile calls fetch on config.fileUrl, which is validated only by...

CVE-2026-88892

OpenPanel , an analytics platform, has a server-side request forgery (SSRF) vulnerability in its data importer. The parseRemoteFile function in packages/importer/src/providers/umami.ts calls plain fetch() on a caller-supplied fileUrl validated only by z.string().url(), bypassing the project's exi...

PT-2026-89403

OpenPanel is an analytics platform. In all versions no patched release available at time of publication, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard apps/api/src/utils/safe-fetch.ts. In packages/importer/src/providers/umami.ts,...

CVE-2026-88001 Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEBFETCHFILTERLIST or private-address controls to HTTP redirect destinations when AIOHTTPCLIENTALLOWREDIRECTS was enabled. An authenticated user...

CVE-2026-86539 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

CVE-2026-86539

knowns through version 0.33.0 contains a server-side request forgery (SSRF) vulnerability in the POST /api/embedding-models/test endpoint. The endpoint issues outbound requests to caller-supplied destinations without validating the target, allowing unauthenticated attackers to enumerate internal ...

CVE-2026-86539: Server-Side Request Forgery (SSRF)

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

CVE-2026-51699

The TOTOLINK T6 wireless dual-band Mesh router (version 4.1.5cu.748_B20211015 ) is vulnerable to an improper access control issue within the setDmzCfg function. An unauthenticated attacker can exploit this vulnerability by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. This ...

CVE-2026-51699: Improper Access Control

Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi...