CVE-2026-62668

Grav API Plugin (RESTful API for Grav CMS) prior to 1.0.6 is vulnerable to SSRF via unrestricted cURL protocols in webhook dispatch. The WebhookController.php accepts webhook URLs with only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS...

CVE-2026-76239

Stigmem versions before 0.9.0a11 do not validate the delivery_address parameter in webhook subscription creation, enabling authenticated users to force the server to send POST requests to internal services (loopback/private network), achieving blind SSRF. Remediation: upgrade to 0.9.0a11 or later...

EUVD-2026-62403

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

CVE-2026-76239 Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address

Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-si...

EUVD-2026-62466

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...

CVE-2026-76225 ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV

ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud metadata endpoints to make the ArcadeDB...

CVE-2026-76164 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources

AIL Framework contains a server-side request forgery SSRF vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can...

CVE-2026-76164

CVE-2026-76164 is a non-blind SSRF in the AIL Framework crawler submission functionality. A low-privileged authenticated user can submit arbitrary URLs for crawling without adequate destination validation. Manual crawler tasks bypass the existing domain blacklist (assigned non-zero priority), and...

CVE-2026-17565 Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...

PT-2026-78420

Name of the Vulnerable Software and Affected Versions Stigmem versions prior to 0.9.0a11 Description Authenticated users can perform blind Server-Side Request Forgery SSRF attacks by specifying internal loopback or private network destinations in the delivery address parameter during the creation...

PT-2026-78407

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1 Description An issue exists in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud...

CVE-2026-55162

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded certificate extensions and used them in crlverify and ocspverify without adequate destination validation. An authenticated operator could subm...

EUVD-2026-61151

Lemur manages TLS certificate creation. Prior to 1.9.3, validaterevocationurl in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects without validating each Location target, ...

PT-2026-77139

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...

CVE-2026-56677

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Summary A Server-Side Request Forgery SSRF vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belong...

EUVD-2026-60471

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

BIT-GHOST-2026-70595 Ghost: Server-Side Request Forgery Mitigation Issue

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

EUVD-2026-58823

A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...

CVE-2026-74247

A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...