CVE-2026-85662 Marqo 2.26.0 Server-Side Request Forgery via Media URLs

Marqo 2.26.0 contains a server-side request forgery vulnerability in the adddocuments endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit downloadimagefromurl and fetchcontentsample functions which...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-85650

Trigger.dev versions before 4.5.2 contain a server-side request forgery (SSRF) vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal servi...

CVE-2026-85650 Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

CVE-2026-85614

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue request...

PT-2026-85541

Douyin TikTok Download API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services includi...

PT-2026-85672

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.2 Description A URL parser discrepancy allows a remote authenticated attacker to obtain sensitive information from internal services. This issue occurs because a backslash can be used to bypass...

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85164

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the setapiuserImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal...

CVE-2026-73745

A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some information handled by the affected system. Successful exploitation could allow an attacker to gain insight into internal services and workflows, increasing the risk o...

CVE-2026-84207

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket...

CVE-2026-84207

Heym before 0.0.98 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its WebSocket Send and WebSocket Trigger workflow nodes. The root cause is the failure to apply SSRF egress guards to these nodes, allowing authenticated users to craft workflow nodes with arbitrary URLs and h...

CVE-2026-84207 Heym before 0.0.98 SSRF via WebSocket endpoints

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket...

CVE-2026-82556

A flaw was found in Forgejo. A remote attacker could exploit a server-side request forgery SSRF vulnerability by manipulating the net.LookupIP function within the Repository Migration Handler. This could allow the attacker to force the server to make requests to arbitrary network resources,...

PT-2026-84449

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description An issue in the API endpoint allows an unauthenticated remote attacker to view information handled by the system. This could enable an attacker to gain insight into...

CVE-2026-51696

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose internal services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51696

CVE-2026-51696 affects the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ), where an incorrect access control flaw in the setPortForwardRules function allows an unauthenticated attacker to expose internal services by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability i...

CVE-2026-51696

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose internal services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68591

Incorrect access control in the setPortForwardRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to expose internal services via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82246

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...