CVE-2026-72598

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72597

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-72784

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a server-side request forgery vulnerability in the GraphQL saveAsset mutation, which fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp does not cover CGNAT 100.64.0.0/...

CVE-2026-72784

CVE-2026-72784 affects Craft CMS versions 5.0.0-RC1 through 5.10.5 and 4.0.0-RC1 through 4.18.1. The vulnerability is a server-side request forgery (SSRF) in the GraphQL saveAsset mutation that fetches an attacker-supplied URL server-side. The anti-SSRF validation is incomplete: validateIp() does...

CVE-2026-72768 n8n before 2.32.1 SSRF Protection Bypass via MCP Client

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

CVE-2026-72768

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...

CVE-2026-72744 Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

MAL-2026-13732 Malicious code in joule-btp-extension (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91439e7a69d936aa8a65b16561f48e9d9abab26fc8e3af4087da8d367cfd2210 On pip install, setup.py runs a collectandexfiltrate routine that reads /private/etc/passwd, /private/etc/hosts, and /private/etc/sudoers; captures...

CVE-2026-50236 Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

EUVD-2026-56133

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-50236

An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network...

CVE-2026-72606

Pinry (through version 2.1.13) is affected by a Server-Side Request Forgery (SSRF). The vulnerability arises in the pin-from-URL feature: it passes user-supplied URLs directly to requests.get() without host/IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true, enabling anonymous triggering...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72598 Apioo Fusio - Server-Side Request Forgery

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

EUVD-2026-56037

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72598

CVE-2026-72598 affects Apioo Fusio 8.8.3. A server‑side request forgery occurs when authenticated consumer‑role users register a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax with FILTER_VALIDATE_URL but imposes no IP or host denylist. When the r...

CVE-2026-72598

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72597

CVE-2026-72597 affects Friendica (2026.08-dev branch). The vulnerability is a server-side request forgery (SSRF) in the link-preview endpoint, which fetches a user-provided URL without an internal IP deny list. This allows an authenticated user with a free self-registered account to probe interna...

EUVD-2026-56036

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...