CVE-2026-81421

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

EUVD-2026-66817

Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...

PT-2026-82468

Unauthenticated Cross Site Request Forgery CSRF in GeoDirectory = 2.8.176 versions...

PT-2026-82850

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...

CVE-2026-75814: Cross-Site Request Forgery (CSRF)

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of...

PT-2026-82806

A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s fetch page/s fetch pattern of the file src/scrapling fetch mcp/ fetcher.py. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely...

PT-2026-82579

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 24.0 Description An issue exists in the isSSRFSafeURL function where it fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass...

PT-2026-82562

FrontAccounting through 2.4.20 generates a CSRF token in end form in includes/ui/ui controls.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/change current user password.php call check csrf token to validate it. No financial transaction...

CVE-2026-75332

Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...

CVE-2026-65956

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2025-62341

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

CVE-2026-65956 KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

EUVD-2026-66810

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2026-65956

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2025-62341

HCL Connections contains a server-side request forgery (SSRF) vulnerability that becomes exploitable when an internal server is compromised. In certain scenarios, an attacker can send unauthorized requests, potentially leading to information disclosure or security bypass . The CVSS 3.1 base score...

CVE-2025-62341 HCL Connections is vulnerable to server-side request forgery (SSRF)

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

CVE-2026-77573

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-77573 Weblate: DNS rebinding in VCS operations allows server-side request forgery

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-77573

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-71172

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery SSRF vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...