EUVD-2026-71266

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy...

CVE-2026-85699

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the...

CVE-2026-85691

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85675

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-85650

Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSRF protection. Authenticated users with organization membership can create alert channels with URLs targeting internal services and metadat...

EUVD-2026-71257

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

CVE-2026-85699

jina-ai reader is affected by a server-side request forgery (SSRF) vulnerability. URL validation is applied only to the initial request but is not re-applied to subsequent redirect hops . An attacker can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, ...

CVE-2026-85699 jina-ai reader server-side request forgery via redirect validation bypass

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the...

CVE-2026-85699 jina-ai reader server-side request forgery via redirect validation bypass

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the...

EUVD-2026-71140

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85691 MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85691 MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85691 MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON...

CVE-2026-85691

MegaParse 0.0.55 contains an unauthenticated server-side request forgery (SSRF) in the POST /v1/url endpoint, which fetches caller-supplied URLs server-side without requiring authentication. Attackers can supply internal service URLs or cloud metadata endpoints and read their responses directly f...

CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-85675 OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extractdocumentcontent tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources...

CVE-2026-85675

OWL 's DocumentProcessingToolkit contains a server-side request forgery (SSRF) vulnerability in the extract_document_content tool. The tool fetches caller-supplied URLs without scheme, host, or IP filtering , allowing attackers to inject malicious URLs via prompt injection and cause the server to...

EUVD-2026-71122

OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...

CVE-2026-85666 ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url

OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...

CVE-2026-85662 Marqo 2.26.0 Server-Side Request Forgery via Media URLs

Marqo 2.26.0 contains a server-side request forgery vulnerability in the adddocuments endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit downloadimagefromurl and fetchcontentsample functions which...