EUVD-2026-58627

SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification publish mode...

CVE-2026-78593

Kibana 's Cribl integration contains an insufficiently validated configuration field that allows an authenticated user with Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template. This results in an Elasticsearch ingest pipeline being writt...

CVE-2026-85305

Server-Side Request Forgery SSRF vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1...

CVE-2026-84761

Unauthenticated Server Side Request Forgery SSRF in LiteSpeed Cache = 7.9 versions...

EUVD-2026-63472

unstructured: Server-Side Request Forgery in the URL-based partitioning...

GHSA-4MVJ-M6J5-PMF7 unstructured: Server-Side Request Forgery in the URL-based partitioning

Summary Server-Side Request Forgery in unstructured. The url= argument of partition, partitionhtml, and partitionmd is fetched via requests.get with no host validation. The response body is returned as Element text, so this is a full-read SSRF — attackers reach loopback admin APIs, internal HTTP...

CVE-2026-85305 WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1...

EUVD-2026-70557

Server-Side Request Forgery SSRF vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1...

WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by MYUNGYONG LEE in WordPress Plugin SEOPress versions = 10.1...

SUSE CVE-2026-84377

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...

EUVD-2026-70598

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...

CVE-2026-85180 Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal...

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85179

Label Studio versions through 1.23.0 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the webhook functionality (specifically in webhooks/utils.py). The application fails to validate webhook URLs , allowing authenticated users to dispatch outbound requests to internal network...

EUVD-2026-70483

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85179 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload...

CVE-2026-85163

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epglink parameter during video upload, which is validated only for syntax and...

EUVD-2026-70413

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...

CVE-2026-85106 NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launch...