EUVD-2026-80183

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

CVE-2026-92775: Server-Side Request Forgery (SSRF)

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the serv...

PT-2026-94093

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0 Description The WebFetchTool component contains a server-side request forgery SSRF issue, where the validate url function fails to block private addresses and internal IP ranges. This allows attackers to...

CVE-2026-92576: Server-Side Request Forgery (SSRF)

HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the validateurl function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost...

PT-2026-93813

Name of the Vulnerable Software and Affected Versions MLRun versions prior to 1.11.0 Description An issue exists in the WebhookNotification handler that allows authenticated users to perform server-side request forgery SSRF. By updating a run with a malicious webhook notification, an attacker can...

EUVD-2025-210923

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

PT-2026-93946

A Server-Side Request Forgery vulnerability exists in sat proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl setoptCURLOPT URL without host or scheme validation. An unauthenticated remote attacker can leverage this to...

PT-2026-93882

Name of the Vulnerable Software and Affected Versions Quickwit versions prior to 0.9.1 Description Insufficient validation of the host and scheme in the queue url parameter within SQS file sources allows an attacker to force the node to send requests to arbitrary internal addresses. By providing ...

CVE-2026-92804: Server-Side Request Forgery (SSRF)

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

CVE-2026-92719: Server-Side Request Forgery (SSRF)

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-87907: Exposure of Sensitive Information to an Unauthorized Actor

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

PT-2026-94087

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.60.7 Description An issue exists where the software fails to validate the Goto URL action within browser steps. This allows unauthenticated attackers to access internal network addresses by providing...

CVE-2025-56563

A Server-Side Request Forgery vulnerability exists in satproxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curlsetoptCURLOPTURL without host or scheme validation. An unauthenticated remote attacker can leverage this to make...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38427)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setDmzCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST reques...

CVE-2026-76559: Server-Side Request Forgery (SSRF)

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

PT-2026-93284

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their...

CVE-2026-92569: Server-Side Request Forgery (SSRF)

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...

CVE-2026-87161

Vulnerability in the Oracle HRMS India product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS India. While th...

CVE-2026-87159

Vulnerability in the Oracle HRMS India product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS India. Successf...

CVE-2026-87153

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...