CVE-2026-50237

A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata...

CVE-2026-72606

Pinry (through version 2.1.13) is affected by a Server-Side Request Forgery (SSRF). The vulnerability arises in the pin-from-URL feature: it passes user-supplied URLs directly to requests.get() without host/IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true, enabling anonymous triggering...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

EUVD-2026-56037

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72598

A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via...

CVE-2026-72598

CVE-2026-72598 affects Apioo Fusio 8.8.3. A server‑side request forgery occurs when authenticated consumer‑role users register a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax with FILTER_VALIDATE_URL but imposes no IP or host denylist. When the r...

CVE-2026-72597

CVE-2026-72597 affects Friendica (2026.08-dev branch). The vulnerability is a server-side request forgery (SSRF) in the link-preview endpoint, which fetches a user-provided URL without an internal IP deny list. This allows an authenticated user with a free self-registered account to probe interna...

CVE-2026-72597

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-72560 HumanSignal Label Studio - Server-Side Request Forgery

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...

CVE-2026-72560

CVE-2026-72560 affects HumanSignal Label Studio (up to 1.24.0.dev0). The import-from-URL endpoint can fetch caller-supplied URLs, including internal loopback addresses, because SSRF_PROTECTION_ENABLED is false by default in the default installation. An authenticated user could use this to reach i...

EUVD-2026-56030

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...

CVE-2026-72560

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...

CVE-2026-72552

The CVE-2026-72552 entry concerns Dub and a server‑side request forgery (SSRF) via the metatags edge endpoint. The endpoint allows unauthenticated callers to fetch any caller‑supplied URL, enabling requests to internal or external hosts without a denylist. This could enable internal network disco...

CVE-2026-72552 Dub Dub - Server-Side Request Forgery

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or...

CVE-2026-72552

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or...

EUVD-2026-56022

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or...

CVE-2026-13739

The CVE-2026-13739 vulnerability affects a legacy Command Center endpoint, described as an unauthenticated Server-Side Request Forgery (SSRF) involving handling of arbitrary target URLs. The issue permits external control over requests initiated from the vulnerable system, with potential impact t...

CVE-2026-13739 Server-Side Request Forgery (SSRF)

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery SSRF vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center...

EUVD-2026-56000

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery SSRF vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center...

CVE-2026-73160

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetchmispevent and /mispsearchevents endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain...