CVE-2026-13700

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

CVE-2026-13700 WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

BIT-MONGODB-2026-13066 Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...

BIT-CONSUL-2026-16328 consul-mcp-server vulnerable to server side request forgery leading to token exposure

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an...

CVE-2026-19984 jkawamoto mcp-florence2 __init__.py get_images server-side request forgery

A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...

CVE-2026-19984

CVE-2026-19984 affects jkawamoto/mcp-florence2 (up to 0.3.13). The vulnerability is in the get_images function of src/mcp_florence2/init .py where the src argument is manipulated, enabling server-side request forgery (SSRF). The issue can be triggered remotely and a PoC exploit has been published...

PT-2026-76797

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.26.0 Description The MiMoV2OmniMultiModalProcessor in vllm/transformers utils/processors/mimo v2 omni.py improperly handles image and audio strings. By passing attacker-controlled strings through fetch image,...

CVE-2026-67868

A heap-based out-of-bounds write vulnerability exists in S2OPC version 1.7.3 . The flaw occurs during server-side EventFilter handling while processing CreateMonitoredItems , which allows a remote attacker to execute arbitrary code . This is a memory corruption issue where data is written outside...

PT-2026-73385

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...

PT-2026-76876

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21 Mattermost versions 11.8.0 through 11.8.3 Description Insufficient server-side validation of BoardMember.Scheme fields during insert and archive-import...

CVE-2026-38165

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

CVE-2026-38165: Improper Control of Generation of Code

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

CVE-2026-65974: Improper Neutralization of Special Elements Used in a Template Engine

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.rendertemplate is exposed without forcing restrictglobals, allowing server-side template injectio...

CVE-2026-38165

A Server-Side Template Injection (SSTI) vulnerability exists in the Velocity template engine configuration of xdocreport versions 0.9.2 through 2.2.0 (specifically affecting fr.opensagres.xdocreport.template.velocity). The flaw occurs because the application fails to properly validate or filter i...

CVE-2026-13700: Server-Side Request Forgery (SSRF)

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

PT-2026-73209

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

PT-2026-76812

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

PT-2026-73287

Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

PT-2026-73283

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...

PT-2026-76819

Name of the Vulnerable Software and Affected Versions 9Router versions 0.5.4 and earlier Description A Server-Side Request Forgery SSRF exists in the dashboard via the POST '/api/auth/oidc/test' endpoint. The application accepts a user-controlled issuerUrl parameter and passes it to the...