PT-2026-68646

Name of the Vulnerable Software and Affected Versions Premium SEO WordPress plugin affected versions not specified Description The Premium SEO WordPress plugin is malicious and contains an unauthenticated backdoor. This backdoor allows an unauthenticated attacker to create a hidden administrator...

CVE-2026-14812: Hidden Functionality

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker...

PT-2026-68366

Name of the Vulnerable Software and Affected Versions heshengtao super-agent-party versions prior to 0.4.2 Description Remote attackers can trigger server-side request forgery SSRF by manipulating the url argument within the sanitize proxy url function located in the server.py file of the extensi...

@geode/opengeodeweb-front (>=9.13.1-rc.9, <=10.0.2-rc.4), @qingwave/cclens (>=0.1.0, <=0.2.0) +1 more potentially affected by CVE-2026-71318 via @nuxt/nitro-server (>=3.20.0, <=3.21.9)

@nuxt/nitro-server NPM version =3.20.0, =9.13.1-rc.9, =0.1.0, =3.20.0, =3.21.9 Source cves: CVE-2026-71318 Source advisory: SNYK:JS-NUXTNITROSERVER-18565119...

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply...

CVE-2026-34966

Gitea before 1.27.0 is affected by a server-side request forgery (SSRF) in HTTP fetch operations used by migration and OAuth avatar paths (Go http.Get without a custom DialContext). An authenticated user can supply arbitrary URLs through release asset downloads, PR patch URLs, or OAuth avatar end...

CVE-2026-66885

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

CVE-2026-55523

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.webcrawltools.webcrawl function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server is affected by a server-side request forgery (CVE-2026-14529)

Summary The security issue described in CVE-2026-14529 has been identified in WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affecte...

CVE-2026-55523 PraisonAI has a`web_crawl` SSRF protection bypass via unchecked redirect targets

PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the praisonaiagents.tools.webcrawltools.webcrawl function is vulnerable to server-side request forgery. While it validates the initially supplied URL and blocks direct loopback and private destinations, its default httpx...

CVE-2026-7657

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery SSRF due to incomplete and ineffective SSRF protection enforcement...

CVE-2026-7657

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery SSRF due to incomplete and ineffective SSRF protection enforcement...

CVE-2026-70434

A cross-site request forgery CSRF vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2026-70432

A cross-site request forgery CSRF vulnerability in Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...

EUVD-2026-53526

A cross-site request forgery CSRF vulnerability in Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-9081 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...

CVE-2026-7657

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery SSRF due to incomplete and ineffective SSRF protection enforcement...

CVE-2026-17617

IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...

Server-side Request Forgery (SSRF)

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the net.fetch or net.request. An attacker can access local file contents by redirectin...

CVE-2026-9203 Server-side request forgery in Progress MarkLogic Server

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resourc...