Keycloak-12.0.1-CVE-2020-10770

Keycloak-12.0.1-CVE-2020-10770 Keycloak 12.0.1 - 'requesturi ' Blind Server-Side Request Forgery SSRF Unauthenticated Exploit-DB-50405 Expected outcome: Port scan of localhost or internally accessible hosts. Intended only for educational and testing in corporate environments. This Exploit was...

WordPress <= 6.2 - Server Side Request Forgery

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. id: CVE-2022-3590 info: name: WordPress = 6.2 - Server Side...

CVE-2026-126770

OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, ...

EUVD-2026-123675

OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make the backend connect to arbitrary destinations through the database Test Connection feature. Attackers can set a database entry's host and port to localhost, internal addresses, ...

CVE-2026-123753

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and...

CVE-2026-123753

Apache Axis2/Java versions through 2.0.1 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. An unauthenticated caller can provide a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address; the engine then opens a new server-side connection to that address to deliver responses or ...

CVE-2026-123753 Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and...

CVE-2026-123753 Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and...

EUVD-2026-119936

Server-Side Request Forgery SSRF vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and...

CVE-2026-123119

The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x...

CVE-2026-123204

Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata...

CVE-2026-123201

Buku (bukuserver) versions through 5.1.1 are vulnerable to an unauthenticated server-side request forgery (SSRF) . The flaw exists in the /api/fetch_data and /api/network_handle endpoints, where the application fails to properly validate the url parameter. Attackers can bypass the weak is_bad_url...

CVE-2026-123201 buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Buku bukuserver through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetchdata or /api/networkhandle. Attackers can target loopback, private, or cloud metadat...

CVE-2026-123201 buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Buku bukuserver through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetchdata or /api/networkhandle. Attackers can target loopback, private, or cloud metadat...

CVE-2026-105967

The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses...

EUVD-2026-115681

The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses...

EUVD-2026-111730

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response...

VulnCheck KEV: CVE-2026-10526

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

CVE-2026-114076

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud...

CVE-2026-114076 Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud...