8412 matches found
CVE-2026-66437
Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...
EUVD-2026-49233
Unauthenticated Server Side Request Forgery SSRF in AffiliateX = 2.3.5 versions...
CVE-2026-65558 WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in AffiliateX = 2.3.5 versions...
CVE-2026-59552
Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...
CVE-2026-57917
proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing the reading of local files, depending on the parser's configuration. The XML External Entity XXE vulnerability is triggered simply by previewing a file in the file...
CVE-2026-17534
Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...
CVE-2026-17534 Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects
Kimi Code @moonshot-ai/kimi-code before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call for example via prompt injectio...
Next.js Framework 14.1.1 < 15.5.21 / 16.x < 16.2.11 SSRF
The Next.js Framework on the remote host is affected by a server-side request forgery vulnerability: - When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host Server-Side Request Forgery. This requires the attacker's...
Next.js Framework 12.x < 15.5.21 / 16.x < 16.2.11 SSRF
The Next.js Framework on the remote host is affected by a server-side request forgery vulnerability: - A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a...
PT-2026-65314
Name of the Vulnerable Software and Affected Versions Simple Link Directory Pro versions prior to 15.0.7 Description An unauthenticated Server Side Request Forgery SSRF exists in the plugin. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an...
PT-2026-65112
JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery SSRF. An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary...
PT-2026-65321
Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...
CVE-2026-17458 mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery
A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...
PT-2026-64809
Name of the Vulnerable Software and Affected Versions openclaw-cn versions prior to 0.2.2 Description An issue exists in the Browser Control HTTP API component within the clickViaPlaywright function located in the src/browser/routes/agent.act.ts file. A remote attacker can perform a manipulation...
MGASA-2026-0300 Updated wget packages fix security vulnerabilities
Updated wget packages fix security vulnerabilities: -CVE-2026-58469 Wget incorrectly handled Metalink documents containing a whitespace-only URL. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Mageia 9 and Mageia 10. -CVE-2026-58470 : Wget...
EUVD-2026-44937
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref...
CVE-2026-57106
Server-side request forgery ssrf in Data Quality allows an unauthorized attacker to elevate privileges over a network...
WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin AffiliateX versions = 2.3.5...
Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty
Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-11714 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3...