EUVD-2026-67034

AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint ...

CVE-2026-81093

Apify Actors MCP Server before version 0.9.12 is vulnerable to Server-Side Request Forgery (SSRF) via the get-html-skeleton tool. The URL validation function (isValidHttpUrl) in src/utils/generic.ts confirmed only that the argument began with an http/https scheme and parsed as a URL, without insp...

CVE-2026-81093 Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...

CVE-2026-81093 Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/gethtmlskeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a U...

CVE-2026-81091 mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...

CVE-2026-75898

CVE-2026-75898 — Componente Invoke di RAGFlow SSRF Server-Side Request Forgery CWE-918 nel componente "Invoke" del flusso agente di RAGFlow, prima della versione 0.26.3...

CVE-2026-26801-pdfmake-ssrf

pdfmake SSRF-Schwachstellen-PoC Zusammenfassung der Schwachstelle...

GitLab-SSRF-CVE-2021-22214

CVE-2021-22214 POC per CVE-2021-22214: Gitlab SSRF Descrizione L'installazione remota di GitLab contiene una vulnerabilità di Server-side request forgery SSRF dovuta all'abilitazione della rete interna per i webhook. Un attaccante remoto non autenticato può sfruttare un'istanza GitLab con...

OPENSUSE-SU-2026:21665-1 Security update for wget

This update for wget fixes the following issues: Security issued fixed: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread...

EUVD-2026-66829

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2026-81421

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2022-46364-htb-ctf

Ferramenta de Exploração SOAP DevArea CVE-2022-46364 Descrição Este exploit especializado tem como alvo o ambiente DevArea no Hack The Box. Ele aproveita uma vulnerabilidade crítica no Apache CXF 3.2.14 CVE-2022-46364 para realizar Inclusão de Arquivo Local LFI e Falsificação de Solicitação do La...

EUVD-2026-66817

Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...

PT-2026-82806

A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s fetch page/s fetch pattern of the file src/scrapling fetch mcp/ fetcher.py. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely...

CVE-2026-34964

Adminer before 5.5.0 contains a server-side request forgery vulnerabil...

CVE-2026-65956

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2025-62341

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

CVE-2025-55853

CVE-2025-55853 - Inclusioni Locali di File tramite Server Side Request Forgery SoftVision webPDF prima della versione 10.0.2 è vulnerabile a Server-Side Request Forgery SSRF. Informazioni Questo PoC per CVE-2025-55853 dimostra Server-Side Request Forgery nel tool webPDF webPDF. utilizzato per...

CVE-2025-62341 HCL Connections is vulnerable to server-side request forgery (SSRF)

HCL Connections is vulnerable to server-side request forgery SSRF when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass...

CVE-2025-62341

HCL Connections contains a server-side request forgery (SSRF) vulnerability that becomes exploitable when an internal server is compromised. In certain scenarios, an attacker can send unauthorized requests, potentially leading to information disclosure or security bypass . The CVSS 3.1 base score...