CVE-2026-65842 Plate: SSRF with response disclosure in DOCX image embedding

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the...

CVE-2026-65842 Plate: SSRF with response disclosure in DOCX image embedding

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the...

CVE-2026-61704

In the npm package link-preview-js , the resolveDNSHost function in index.ts validates only one resolved IP address but then fetches using the original hostname, enabling DNS rebinding that bypasses SSRF protections and lets server-side preview fetches reach internal HTTP resources. Redirect hand...

CVE-2026-61704 link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address...

EUVD-2026-63439

Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address...

CVE-2026-63044

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-63044 Apache InLong: Authenticated SSRF via POST /api/node/testConnection

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

CVE-2026-63044

CVE-2026-63044 is a Server-Side Request Forgery (SSRF) vulnerability in Apache InLong Manager , affecting versions 2.0.0 through before 2.4.0 . Any authenticated user (no admin role required) can abuse the POST /api/node/testConnection endpoint to force the server to make outbound HTTP requests o...

EUVD-2026-63477

Server-Side Request Forgery SSRF vulnerability in Apache InLong. Any authenticated user no admin role required can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0...

Microsoft Exchange Online Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network...

Microsoft Entra ID Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

Microsoft Copilot in Azure Information Disclosure Vulnerability

Server-side request forgery ssrf in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network...

Azure Data Factory Information Disclosure Vulnerability

Server-side request forgery ssrf in Azure Data Factory allows an unauthorized attacker to disclose information over a network...

Azure SQL Database Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

Azure Virtual Machines Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network...

CVE-2026-64968

ATutor's import functionalities allow an authenticated administrator to perform Server-Side Request Forgery, reaching arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// when PHP URL wrappers are enabled. The product is no longer supported and remains unpatched;...

CVE-2026-64968 Server-Side Request Forgery in ATutor

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2026-77085

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

CVE-2026-77069

n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests use n8n's SSRF-protected HTTP client, the token exchange uses a separate client with no...