GHSA-4P3G-4HCJ-WPVX prebid-server's request forgery vulnerability allows for possible host environment data extraction

Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing...

EUVD-2026-50401

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

CVE-2026-54735

Prebid Server (open-source in real-time advertising auctions) contains a vulnerability (CVE-2026-54735) in versions prior to 4.4.0 where certain bidder adapters interpolate user-supplied parameters into outbound request URLs without proper host/subdomain validation, enabling crafted bid requests ...

CVE-2026-54735 prebid-server's request forgery vulnerability allows for possible host environment data extraction

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...

EUVD-2026-50236

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This...

CVE-2026-9720

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcradminpagehtml function. This makes it possible for...

CVE-2026-9720 Facturación Electrónica Costa Rica <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcradminpagehtml function. This makes it possible for...

CVE-2026-11974

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

CVE-2026-11974 Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

CVE-2026-11974 Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

CVE-2026-11974: Improper Limitation of a Pathname to a Restricted Directory

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

PT-2026-65867

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server version 9.0 IBM WebSphere Application Server version 8.5 IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 Description Server-side request forgery SSRF is possible when the SIP...

PT-2026-65870

Name of the Vulnerable Software and Affected Versions The product name cannot be determined versions prior to 0.5.2 Description A server-side request forgery SSRF bypass allows attackers to circumvent host-based allowlists. This occurs due to a parser differential between net.urllib and net.http...

PT-2026-65779

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky s media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import sidebars function passing user-supplied URLs from imported JSON data to file get contents...

CVE-2026-54691

datamodel-code-generator generates Python data models from schema definitions. From 0.9.1 until 0.61.0, src/datamodelcodegenerator/http.py http.getbody accepts --url targets and redirect chain targets without host/IP validation, allowing server-side request forgery against loopback, private,...

CVE-2026-55391

CVE-2026-55391 affects the datamodel-code-generator project. Prior to version 0.63.0, the tool validates a URL host in http.py via get_body, _validate_url_for_fetch, and _get_ips_from_host, but then allows httpx to resolve the host again for the connection, enabling DNS rebinding to bypass allow_...

CVE-2026-55391 datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...

CVE-2026-55391 datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamodelcodegenerator/http.py through...

Server-side Request Forgery (SSRF)

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the process that handles dereferencing JSON-Schema $ref values pointing to HTTP or HTTPS URLs without proper IP or host validation, scheme...