CVE-2026-5096: Server-Side Request Forgery (SSRF)

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the loadpreviousfieldvalue method in class-evf-form-task.php accepting arbitrary URL values from $POST data for upload fields without domain restriction,...

CVE-2026-55848: Improper Restriction of XML External Entity Reference

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and fetches XML parsed by...

CVE-2026-54745: Improper Access Control

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...

PT-2026-83327

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1 Description An authenticated attacker can perform server-side request forgery SSRF, a flaw that allows the system to be coerced into making unauthorized requests. This can be used for network...

PT-2026-83133

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the load previous field value method in class-evf-form-task.php accepting arbitrary URL values from $ POST data for upload fields without domain...

PT-2026-83226

Name of the Vulnerable Software and Affected Versions Kubeflow Pipelines versions prior to 2.17.0 Description The frontend exposes an unauthenticated server-side request forgery SSRF issue. The routePathWithReferer function accepts an arbitrary HTTP or HTTPS target and passes its origin to...

PT-2026-83308

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal netwo...

PT-2026-83285

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-78498 Dimension Server-Side Request Forgery via Email Server Test Settings

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78499 Dimension SSRF via FTP Server Test Connection

A server-side request forgery SSRF vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-81848

A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function sfetchpage/sfetchpattern of the file src/scraplingfetchmcp/fetcher.py. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. Upgradi...

CVE-2026-75814 Ebyte NA111-M Cross-Site Request Forgery

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...

MGASA-2026-0339 Updated python-django packages fix security vulnerabilities

CVE-2026-15307: Server-side file-write and request forgery via spatial lookups CVE-2026-15337: Potential denial-of-service vulnerability in checkforlanguage CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections CVE-2026-15920: Potential cross-site scripting via...

Updated python-django packages fix security vulnerabilities

CVE-2026-15307: Server-side file-write and request forgery via spatial lookups CVE-2026-15337: Potential denial-of-service vulnerability in checkforlanguage CVE-2026-15830: Potential denial-of-service vulnerability via nested geometry collections CVE-2026-15920: Potential cross-site scripting via...

EUVD-2026-67179

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-59291 Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-59291

Spring Cloud Function versions 5.0.0–5.0.3, 4.3.0–4.3.4, and 4.2.0–4.2.7 are vulnerable to arbitrary file read and SSRF via the function that processes input data. An attacker can access arbitrary files or make unauthorized network requests by supplying crafted input that is improperly handled. T...

CVE-2026-81678

AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint ...

CVE-2026-81091

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...

SUSE CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...