EUVD-2026-92540

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatarurl from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that...

GHSA-XXV7-2VV3-H682 Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

Summary A project member can create a webhook alert channel whose delivery URL points at an internal address, and trigger.dev's control plane will send the alert there with no SSRF protection. The webhook URL is stored as an unvalidated string and is fetched directly from the webapp server, so a...

PT-2026-103990

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file get contents after only format validation FILTER VALIDATE URL — there is no validation of the request...

CVE-2026-89003

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

EUVD-2026-87894

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

CVE-2026-89003 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

EUVD-2026-87892

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only...

CVE-2026-89003: Server-Side Request Forgery (SSRF)

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

CVE-2026-18424

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first "ValidatedRemoteUrl" is retained and reused for every later URL with that host. A...

CVE-2026-86207: Authentication Bypass by Primary Weakness

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal only APIs...

PT-2026-68144

Name of the Vulnerable Software and Affected Versions Memos affected versions not specified Description Insufficient validation of webhook URLs occurs in the isReservedIP function located in internal/webhook/validate.go. The function checks candidate IPs against a reserved CIDR list but omits the...

CVE-2026-45806

Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from frontend/src/app/main/data/workspace/media.cljs into the backend RPC method :create-file-media-object-from-url in...

CVE-2026-54562

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or...

CVE-2026-54562: Server-Side Request Forgery (SSRF)

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or...

CVE-2025-46651

Tiny File Manager through 2.6 contains a server-side request forgery SSRF vulnerability in the URL upload feature. Due to insufficient validation of user-supplied URLs, an attacker can send crafted requests to localhost by using http://www.127.0.0.1.example.com/ or a similarly constructed domain...

CVE-2024-7207

A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to...

CVE-2024-7207

Rejected reason: Duplicate of CVE-2024-45806...

CVE-2024-7207

...

CVE-2024-29190

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in "android:host", so requests can als...

Storefront 3.7 console displays Store as Internal Only

Question: After upgrade to Storefront 3.7 the store is displayed as Internal Only. In the details it shows Remote Access as Enabled and it also works with Netscaler Gateway. Answer: This is a known issue in Storefront 3.7 and is also mentioned in the edocs...