CVE-2026-69118 Cachet 2.4.1 Authenticated Server-Side Template Injection RCE

Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when...

CVE-2026-72867

Dokploy (PaaS) vulnerability CVE-2026-72867 affects versions 0.29.3–0.29.13. The incomplete fix for CVE-2026-45628 leaves server-side validation missing in packages/server/src/db/schema/compose.ts branch fields, allowing a direct compose.update request to store a malicious customGitBranch, branch...

CVE-2026-72761

The CVE affects the webhook URL validator in website/notifications/webhooks.py, which uses ip.is_global after DNS resolution. IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32) are categorized as globally routable by IANA, causing is_global to return True even w...

WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Gutenverse Companion versions = 2.5.1...

CVE-2026-72591

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72566

A server-side request forgery SSRF vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action...

CVE-2026-72591

The CVE-2026-72591 entry describes a server-side request forgery (SSRF) in the gabehf/Koito project up to v0.3.2. An authenticated user can supply a crafted image_url in PATCH /apis/web/v1/album/{id}/image, causing the server to perform HTTP requests to arbitrary internal or external hosts. The i...

CVE-2026-72591 Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72591

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

EUVD-2026-55215

A server-side request forgery SSRF vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted imageurl value in the PATCH /apis/web/v1/album/id/image endpoint...

CVE-2026-72581 duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint

A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...

EUVD-2026-55225

A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...

EUVD-2026-55240

A server-side request forgery SSRF vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action...

CVE-2026-72566

Summary: CVE-2026-72566 is an SSRF vulnerability in automatisch (through commit 41f3c56) where a low-privileged authenticated user with the 'manage Flow' permission can cause the server to fetch arbitrary URLs via the HTTP Request app's Custom Request action, exposing the full HTTP response body ...

CVE-2026-72566 automatisch - Server-Side Request Forgery via HTTP Request Custom Action

A server-side request forgery SSRF vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action...

CVE-2026-72566

A server-side request forgery SSRF vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action...

CVE-2026-15229

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...

CVE-2026-14860

The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...

CVE-2026-12971

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

Astra Linux – Vulnerability in python-urllib3

urllib3 is a user-friendly HTTP client library for Python. Prior to version 2.5.0, it was possible to disable redirections for all requests by instantiating a PoolManager and specifying retries in a way that disables redirections. By default, requests and botocore users are not affected. An...