CVE-2026-46380 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

CVE-2026-46380 compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module.Finding 1 Critical: SSRF CWE-918The HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to...

PYSEC-2026-2650 misp-modules has nsafe remote resource fetching in expansion

An unsafe remote resource fetching vulnerability existed in MISP Modules expansion modules. The htmltomarkdown module accepted arbitrary HTTPS URLs without sufficient validation, which could allow Server-Side Request Forgery against loopback, private, or link-local network resources. Additionally...

PT-2026-59099

A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module. Finding 1 Critical: SSRF CWE-918 The HTTPSFetcher. do fetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to...

compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module. Finding 1 Critical: SSRF CWE-918 The HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to...

PT-2026-44731

Name of the Vulnerable Software and Affected Versions Trestle affected versions not specified Description Security issues were discovered in the trestle/core/remote/cache.py module. The HTTPSFetcher. do fetch function passes a user-supplied URL directly to requests.get without validation, enablin...

CVE-2026-44363

The CVE-2026-44363 issue affects MISP modules (misp-modules), specifically the html_to_markdown and qrcode modules. Root cause: unsafe remote resource fetching and insufficient URL validation, with qrcode also disabling TLS certificate verification. Impact: potential Server-Side Request Forgery (...

CVE-2026-32030

OpenClaw is affected in versions prior to 2026.2.19 by a path traversal vulnerability in the stageSandboxMedia function when iMessage remote attachment fetching is enabled. An attacker who can tamper with attachment path metadata can disclose files readable by the OpenClaw process on the configur...

CVE-2026-28451 OpenClaw < 2026.2.14 - SSRF via Feishu Extension Media Fetching

OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remote URLs without SSRF protections via sendMediaFeishu function and markdown image processing. Attackers can influence tool calls...