CVE-2026-129094

The @utcp/http library, prior to version 1.1.14 , is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a failure to properly validate the {host} placeholder in call templates, allowing remote manuals to bypass remote-loopback checks. An attacker can supply host arguments such...

EUVD-2026-125435

@utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach loopback services by bypassing the remote-loopback check with a host placeholder. Attackers can supply host arguments like 127.0.0.1 or register tools via Streamable HTTP and SSE...

CVE-2026-123207

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

CVE-2026-123207 LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

CVE-2026-123207

LibreTV before version v2.21.2 is vulnerable to a server-side request forgery (SSRF) protection bypass via DNS rebinding . The flaw exists in the fetchWithSafeRedirects() function, where unpinned DNS resolution allows an attacker to bypass the checkUpstreamAllowed() check. By controlling an autho...

CVE-2026-123207 LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

EUVD-2026-117652

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

CVE-2026-123207 LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

CVE-2026-110719

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

CVE-2026-110719

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

EUVD-2026-101142

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTEDCUSTOMHOSTS is unset. Attackers can send /v1 requests...

EUVD-2026-44639

PraisonAI: DNS rebinding bypass in webcrawl SSRF protection allows internal response disclosure...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the validateKeyIdUrl function. An attacker can access internal resources, cloud metadata, or loopback services by sending a crafted Signature keyId to the public actor inbox route, bypassing network...

CVE-2026-104458

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

CVE-2026-104458

YesWiki versions prior to 4.6.7 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability within the validateKeyIdUrl() function. This flaw allows unauthenticated attackers to bypass the existing SSRF guard by utilizing 6to4, NAT64, or IPv4-compatible IPv6 addresses . By sending a craf...

EUVD-2026-91469

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

CVE-2026-104458

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach...

PYSEC-2026-4096 MCP Atlassian: SSRF Protection Bypass

Environment - Project: sooperset/mcp-atlassian - Affected function: validateurlforssrf - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: POST /mcp - Tested version: 2.14.5 Description The SSRF protection in validateurlforssrf can be bypassed with a URL...

CVE-2026-92813

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...

CVE-2026-92813

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to...