CVE-2026-110628

Versions 0.5.5 through 0.6.0 of Kan are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . This vulnerability exists in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255 . If the S3_ENDPOINT environment variable is unset, an attacker can provide ar...

BIT-GITEA-2026-34966 Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

sap_bo_launchpad-ssrf-timing_attack

SAP BusinessObjects Launchpad SSRF & Timing Attack PoC This Python script is a proof-of-concept PoC for executing SSRF Server-Side Request Forgery and Timing Attacks against SAP BusinessObjects Launchpad. It is designed to help security researchers and professionals identify open ports on a targe...

CVE-2026-110254

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses...

CVE-2026-110254

Finsys Dockhand versions prior to 1.0.45 are vulnerable to a Server-Side Request Forgery (SSRF) flaw located in the ipCategory() function within src/lib/server/url-safety.ts. The root cause is a failure to validate NAT64 , 6to4 , and Teredo IPv6 transition ranges. Authenticated attackers can expl...

CVE-2026-110254 Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses...

CVE-2026-110240 Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP

Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding interna...

CVE-2026-110254: Server-Side Request Forgery (SSRF)

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses...

CVE-2026-57143

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxngsearch and the searchweb SearxNG provider pass the LLM-controlled searxngurl parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the...

CVE-2026-57143

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxngsearch and the searchweb SearxNG provider pass the LLM-controlled searxngurl parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the...

EUVD-2026-96907

Shepherd shepherd-ai through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the publicurl guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and...

CVE-2026-108741

The Shepherd (shepherd-ai) software, version 0.3.1 and below, is vulnerable to a Server-Side Request Forgery (SSRF) via DNS Rebinding in the citation-checker extra. The root cause is a Time-of-check Time-of-use (TOCTOU) race condition where the public_url guard validates a resolved address, but t...

PT-2026-110144

Name of the Vulnerable Software and Affected Versions Shepherd shepherd-ai versions prior to 0.3.2 Description A server-side request forgery guard bypass exists in the citation-checker extra. The issue occurs because the public url guard validates a resolved address, but the fetch function...

CVE-2026-108602

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

EUVD-2026-96428

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108583 zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing...

CVE-2026-108115

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector baseurl,...

CVE-2026-108115

Kortix Suna versions 0.10.7 before 0.13.52 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. The root cause is a bypass of the isPrivateIp guard, which can be circumvented by using IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers possessing the project.conn...