CVE-2026-54272

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...

CVE-2026-58342

A flaw was found in Moodle. The quiz feature, which allows users to add section headings, did not include a necessary security token. This vulnerability, known as Cross-Site Request Forgery CSRF, could allow a remote attacker to trick an authenticated user into performing unintended actions withi...

vRealize Operations Manager API - Server-Side Request Forgery Detection

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress JSmol2WP <=1.07 - Local File Inclusion Detection

WordPress JSmol2WP plugin 1.07 is susceptible to local file inclusion via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context...

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery Detection

Onair2 3.9.9.2 and KenthaRadio 2.0.2 have exposed proxy functionality to unauthenticated users. Sending requests to this proxy functionality will have the web server fetch and display the content from any URI, allowing remote file inclusion and server-side request forgery. !/usr/bin/env python3 -...

CVE-2026-58346

A flaw was found in Moodle. A site administrator could exploit a blind Server-Side Request Forgery SSRF vulnerability. This vulnerability exists in the MNet peers management functionality due to insufficient validation of peer hostnames against the cURL blocked hosts configuration. This could all...

BIT-KIBANA-2026-63142 Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

BIT-ELK-2026-63142 Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

CVE-2026-15136

Technical details beyond what is provided in the initial document are not publicly available in the supplied materials. Monitor for updates to verification, remediation status, and affected versions.

EUVD-2026-49667

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-43910: Unintended Proxy or Intermediary

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

PT-2026-65572

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the get urls from html function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validati...

CVE-2026-4912: Server-Side Request Forgery (SSRF)

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...

PT-2026-65612

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.9.1 through 0.60.1 Description An issue exists where the software silently dereferences HTTP or HTTPS URLs provided in JSON Schema $ref values without performing IP or host validation, scheme allow-listing, ...

CVE-2026-65442

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

CVE-2026-65442 WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

CVE-2026-61953

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server-Side Request Forgery (SSRF) in LangChain [CVE-2026-41481]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Server-Side Request Forgery SSRF in LangChain, due to a failure to revalidate to redirect targets, allowing a URL pointing to an attacker-controlled server to potentially redirect to internal, localhost, or cloud metadata endpoints,...

CVE-2026-65923 Potential server-side request forgery in Artifactory Ansible repository handling

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions...

CVE-2026-65925 Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response...