CVE-2026-9203 Server-side request forgery in Progress MarkLogic Server

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resourc...

EUVD-2026-53388

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

GHSA-X5MM-WM4G-J5XV Ghost: Server-Side Request Forgery Mitigation Issue

Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. Vulnerable versions This...

ip-address: ip-address: Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing CIDR suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such a...

CVE-2026-71272

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

CVE-2026-71280

go-shiori's DownloadBookmark() (internal/core/download.go) uses a plain http.Client with no DialContext or destination-IP validation, enabling an authenticated user to supply a bookmark URL of 127.0.0.1 or 0.0.0.0 via POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext. Th...

CVE-2026-71273

OpenBK7231T firmware exposes a CSRF flaw in the /cfg_wifi_set endpoint: configuration changes are accepted via an unauthenticated GET request without a CSRF token. If the web_admin_password_enabled parameter is omitted, an else-branch silently clears the device’s web admin password to an empty st...

CVE-2026-71273

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string...

CVE-2026-71272

CVE-2026-71272 affects Memos’ webhook dispatch function safeDialContext() in internal/webhook/webhook.go. The code resolves the target hostname with net.DefaultResolver.LookupHost(), validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the origina...

CVE-2026-71272 Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...

CVE-2026-71270

Stirling-PDF CVE-2026-71270 affects the POST /api/v1/convert/url/pdf endpoint. Unlike its siblings (html/pdf, file/pdf, markdown/pdf), this endpoint was not updated with CustomHtmlSanitizer/SsrfProtectionService SSRF protections. It only validates that the initial URL resolves to a public IP, the...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by a server-side request forgery

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a server-side request forgery CVE-2026-14529 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products|...

CVE-2026-71250

Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...

CVE-2026-46581

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...

CVE-2026-71238

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

EUVD-2026-53308

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

CVE-2026-71235

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

Server-side Request Forgery (SSRF)

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the rawproxy. An attacker can...

GHSA-H7X2-H6G9-P789 MLflow AI Gateway permits SSRF through an unvalidated api_base

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...