EUVD-2026-118326

Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to bypass SSRF protections and issue arbitrary HTTP requests to internal services and cloud metadata endpoints due to the Squid proxy configuration only defining source ACLs without...

CVE-2026-123207 LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

CVE-2026-123207 LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

EUVD-2026-117652

LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed by exploiting unpinned DNS resolution in fetchWithSafeRedirects. Attackers controlling authoritative DNS can return public addresses during validation and...

CVE-2026-102337

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not...

CVE-2026-102337 Webmin: SSRF exploit in Upload and Download and File Manager modules

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not...

CVE-2026-102337

Webmin, a web-based system administration tool for Unix-like servers, is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.652 . An attacker with access to the File Manager or Upload and Download modules can exploit the server-side URL download functionality because download...

signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher

Summary The app store icon code dist/appstore/icon-probe.js around line 200 and icon-bytes.js around line 138 resolves a plugin's declared signalk.appIcon. Relative paths are pinned to the CDN, but an absolute https URL is used as-is: the server fetches it, follows redirects, and stores any image...

CVE-2026-119712

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser.fetchsingleurl that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web...

CVE-2026-119545

A flaw was found in Forgejo. A remote, unauthenticated attacker can conduct Server-Side Request Forgery SSRF by submitting an arbitrary OpenID identifier to the login endpoint. This issue forces the server to send unverified HTTP requests to internal addresses, loopback interfaces, or cloud...

CVE-2026-119712: pipeshub-ai: PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that…

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser.fetchsingleurl that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web...

Malicious code in bq-helix-build-hook-6ade983e (PyPI)

Source: kam193 ee26602dfa25f574d440b2c1e8ef0a9516fdfb5db4b59f995b88784332476413 During installation the code collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints, and finally exfiltrates them. --- Category: MALICIOUS - Th...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery in Dynamic Client Registration

Summary IBM ContextForge MCP Gateway includes a Dynamic Client Registration DCR feature that automatically discovers and registers OAuth 2.0 clients by fetching authorization server metadata. The registrationendpoint URL obtained from that metadata is posted to without being passed through the...

Signal K Server server-side request forgery vulnerability

Versions prior to Signal K Server 2.34.0, specifically 2.28.0-beta.2, contain a server-side request forgery vulnerability. This flaw arises because the App Store icon fetcher trusts absolute signalk.appIcon URLs; it is thus susceptible to server-side request forgery attacks. Such attacks may allo...

PHPOffice PhpSpreadsheet authorization issue vulnerability

A security vulnerability exists in PHPOffice PhpSpreadsheet versions prior to 1.30.7, from 2.0.0 up to versions prior to 2.1.19, from 2.2.0 up to versions prior to 2.4.8, from 3.3.0 up to versions prior to 3.10.8, and from 4.0.0 up to versions prior to 5.10.0. This vulnerability arises because...

A2A Java SDK Has Server-Side Request Forgery (SSRF) In Push-notification Delivery

- Ecosystem: Maven - Affected package: "org.a2aproject.sdk:a2a-java-sdk-server-common" push-notification delivery - Affected versions: "= 1.2.0.Final" and "1.2.1.Final-SNAPSHOT" on "main" prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request...

GHSA-Q78C-5JJQ-57G8 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

EUVD-2026-104673

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery SSRF that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during...

CVE-2026-8355

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery SSRF that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during...