CVE-2026-62668

Grav API Plugin (RESTful API for Grav CMS) prior to 1.0.6 is vulnerable to SSRF via unrestricted cURL protocols in webhook dispatch. The WebhookController.php accepts webhook URLs with only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS...

EUVD-2026-62403

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

CVE-2026-76239 Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

CVE-2026-76239

Stigmem versions before 0.9.0a11 do not validate the delivery_address parameter in webhook subscription creation, enabling authenticated users to force the server to send POST requests to internal services (loopback/private network), achieving blind SSRF. Remediation: upgrade to 0.9.0a11 or later...

EUVD-2026-62466

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...

CVE-2026-76225 ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...

CVE-2026-76164

CVE-2026-76164 is a non-blind SSRF in the AIL Framework crawler submission functionality. A low-privileged authenticated user can submit arbitrary URLs for crawling without adequate destination validation. Manual crawler tasks bypass the existing domain blacklist (assigned non-zero priority), and...

CVE-2026-76164 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

CVE-2026-17565 Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...

PT-2026-78407

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1 Description An issue exists in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud...

PT-2026-78420

Name of the Vulnerable Software and Affected Versions Stigmem versions prior to 0.9.0a11 Description Authenticated users can perform blind Server-Side Request Forgery SSRF attacks by specifying internal loopback or private network destinations in the delivery address parameter during the creation...

CVE-2026-54492: Server-Side Request Forgery (SSRF)

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular...

CVE-2026-76225: Server-Side Request Forgery (SSRF)

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...

CVE-2026-65985 FUXA: SSRF hardening for `device-webapi-request`

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...

CVE-2026-55162

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crlverify and ocspverify without adequate destination validation. An authenticated operator could subm...

EUVD-2026-61151

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

GO-2026-6139 Server-side request forgery in bidder adapters in github.com/prebid/prebid-server/v4

In github.com/prebid/prebid-server/v4 before 4.4.0, multiple bidder adapters acuityads, bidmachine, relevantdigital, smartyads, tappx, trafficgate, zeroclickfraud interpolate user-supplied host and subdomain parameters into outbound request URLs without validation. A remote attacker can craft bid...

Apache Allura vulnerable to server-side request forgery

Overview Apache Allura provided by The Apache Software Foundation contains the vulnerability listed below: Server-side request forgery CWE-918 - CVE-2026-69223 Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

Server-side Request Forgery (SSRF)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetchimage function in vllm/transformersutils/processors/mimov2omni.py, which directly issues HTTP requests...

PT-2026-77139

Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.26.3 Description A server-side request forgery SSRF issue exists in the agent workflow "Invoke" component located in agent/component/invoke.py. The component constructs outbound request URLs using canvas configurati...