CVE-2026-72848: Server-Side Request Forgery (SSRF)

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

PT-2026-79067

Name of the Vulnerable Software and Affected Versions unstructured versions 0.4.7 through 0.23.x Description The library fails to validate the host when fetching the url argument in the partition, partition html, and partition md functions. This allows an attacker to force the server-side ingesti...

CVE-2026-77066: Server-Side Request Forgery (SSRF)

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.geturl, rssParserConfig with no address validation. The same file guards the subscribe path with validateUrl, which rejects private and reserved ranges through the private-i...

PT-2026-79218

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate...

PT-2026-78922

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user can trigger the server to make requests to arbitrary internal endpoints because the scanFeedsResolver in...

CVE-2026-77151: Use of a Broken or Risky Cryptographic Algorithm

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an...

CVE-2026-77069: Server-Side Request Forgery (SSRF)

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...

CVE-2026-71428: URL Redirection to Untrusted Site

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the JsonToGrpcGatewayFilterFactory process, which permits arbitrary Spring Resource locations to be specified for proto descriptor definitions. An attacker can access internal files or perform...

CVE-2026-76347

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use Server-Side Request Forgery SSRF in report notifications to send system-authenticated...

CVE-2026-76361

Splunk SOAR versions below 8.6.0 are affected by an SSRF vulnerability in the /rest/support/connectivity/.../check_connectivity REST API endpoint, which fails to validate destination hosts before initiating outbound connections, allowing an Administrator-role user to probe internal network reacha...

CVE-2026-76361 Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

CVE-2026-76347

Splunk Secure Gateway's Report Notifications REST API fails to validate notification path values before sending system-authenticated internal requests, allowing non-admin users to trigger SSRF, alter Search Head Cluster state, and cause denial of service. Affected versions: Splunk Enterprise belo...

CVE-2026-54493

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API...

CVE-2026-54492

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular...

CVE-2026-54491

Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost or isSafeUrl check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every...

Path Equivalence

Overview Affected versions of this package are vulnerable to Path Equivalence in its .terraformignore pattern matching, which compares filenames against ignore patterns without normalizing both to a common Unicode form. An attacker with write access to the working directory can cause sensitive...

EUVD-2026-63085

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API...

CVE-2026-54493 Koel: Authenticated Full-Read SSRF via Subsonic Internet Radio Stations

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API...

CVE-2026-54494

Koel (open-source music streaming, Laravel) prior to 9.7.1 has a full-read SSRF (CWE-918) in its outbound-URL guard App\Helpers\Network::isPublicHost(). PHP's filter_var() with FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE does not reject NAT64 (64:ff9b::/96) or 6to4 (2002::/16) IPv6 trans...