PT-2026-69281

Name of the Vulnerable Software and Affected Versions anubissbe ProjectHub-Mcp versions prior to 5.0.1 Description A weakness in the Webhooks API component, specifically within the file backend-fix/complete backend.js, allows for server-side request forgery SSRF. This occurs when the url argument...

EUVD-2026-54793

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-19246

A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function downloadimagedataurl of the file nanobot/providers/imagegeneration.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the...

CVE-2026-47664 Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the $import-pnp operation in Pathling Server accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without...

CVE-2026-47664

Pathling Server before 2.0.0 allows a caller-supplied exportUrl in the $import-pnp operation to target a remote FHIR Bulk Export endpoint, then downloads files and reclassifies them as trusted local file:// imports, bypassing the allowableSources allowlist and enabling authenticated SSRF, credent...

CVE-2026-17597

Nexus Repository 3 contains a Server-Side Request Forgery SSRF vulnerability in the email configuration verification feature. A user holding the nexus:settings:update permission could submit arbitrary host and port values to the email test/verification endpoint, causing the server to attempt...

CVE-2026-17597

Nexus Repository 3 contains a Server-Side Request Forgery (SSRF) in the email configuration verification feature. A user with nexus:settings:update can submit arbitrary host/port values to the email test/verification endpoint, causing the server to initiate outbound connections to internal or res...

CVE-2026-16637

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

EUVD-2026-54479

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

CVE-2026-16637

OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers User-Id, Echo-Token to attacker-controlled endpoints...

CVE-2026-54205 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54205

The vulnerability CVE-2026-54205 affects Tobit Laboratories AG TeamDavid’s Webbox link-storing functionality. The server-side code accepts a pathname parameter that can be a UNC network location (e.g., \Server\Share) without validation, causing outbound connections to attacker-controlled SMB endp...

CVE-2026-54207 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54206 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54204

CVE-2026-54204 affects Tobit Laboratories AG TeamDavid’s Webbox. The search function accepts a pathnameroot parameter that can be set to UNC network locations; the server processes these values without validation, causing outbound connections to attacker-controlled SMB endpoints. This enables una...

CVE-2026-54204 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionality

Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.14.0 Vulnerability Details CVEID:CVE-2026-14620 DESCRIPTION: webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and...

CVE-2026-53983

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-15732

A Server-Side Request Forgery SSFR vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses...

CVE-2026-62857 Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo follows an attacker-controlled links.href value from /.well-known/nodeinfo without scheme, redirect, o...