EUVD-2026-125172

SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fetchBytes performs only a parse-time hostname check instead of using ssrfSafeClient. Attackers can supply a skill URL via the MCP skill install action that redirects or DNS-rebind...

CVE-2026-126393

SiYuan versions prior to 3.8.10 are vulnerable to a Server-Side Request Forgery (SSRF) in the skill-install download path . The root cause is that the fetchBytes function performs only a parse-time hostname check instead of utilizing ssrfSafeClient . An attacker can provide a skill URL via the MC...

EUVD-2026-124960

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

PT-2026-146679

SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fetchBytes performs only a parse-time hostname check instead of using ssrfSafeClient. Attackers can supply a skill URL via the MCP skill install action that redirects or DNS-rebind...

CVE-2026-103980

ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges loopback ::1, ULA fc/fd, link-local...

CVE-2026-125926

Server-side request forgery SSRF in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafte...

CVE-2026-103980

ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges loopback ::1, ULA fc/fd, link-local...

EUVD-2026-124033

ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges loopback ::1, ULA fc/fd, link-local...

CVE-2026-103980 ideon: SSRF protection bypass via IPv6 transition addresses (NAT64 / 6to4 / IPv4-mapped) in link preview

ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges loopback ::1, ULA fc/fd, link-local...

CVE-2026-103980

Prior to version 0.9.6 , the self-hosted visual workspace ideon is vulnerable to Server-Side Request Forgery (SSRF) due to a bypass in the safeFetch protection. The root cause is that the isPrivateIP function in src/app/lib/ssrf.ts fails to recognize several IPv6 transition encodings, including I...

CVE-2026-125926

A Server-side request forgery (SSRF) vulnerability exists in the server registration and update API of Amazon mcp-gateway-registry versions prior to 1.35.0 . This flaw may allow an authenticated remote user to submit a crafted request that forces the gateway to send requests to internal network s...

CVE-2026-125926 Server-side request forgery in the server registration and update API in mcp-gateway-registry

Server-side request forgery SSRF in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafte...

CVE-2026-125926

Server-side request forgery SSRF in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafte...

EUVD-2026-124011

Server-side request forgery SSRF in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafte...

CVE-2026-125926 Server-side request forgery in the server registration and update API in mcp-gateway-registry

Server-side request forgery SSRF in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafte...

CVE-2026-65967

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery SSRF vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting...

CVE-2026-65967

Prior to version 0.34.0 , the Fider feedback portal is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is the insufficient validation of webhook URLs , which allows the application to fetch user-controlled URLs without restricting access to internal or external network resourc...

CVE-2026-65967

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery SSRF vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting...

EUVD-2026-123704

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery SSRF vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting...

PT-2026-145449

ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges loopback ::1, ULA fc/fd, link-local...