CVE-2026-76820

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

CVE-2026-76680

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery SSRF attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WA...

CVE-2026-37197

CVE-2026-37197 - NukeViet CMS v4.5.07 中的服务端请求伪造（SSRF）漏洞 概述 VINADES JSC NukeViet CMS v4.5.07 的 管理员远程上传功能 中存在 服务端请求伪造（SSRF） 漏洞。该问题允许已认证的管理员在上传文件时提供精心构造的远程文件 URL，从而触发指向任意 URL 的服务端 HTTP 请求。 此漏洞可能允许攻击者与内部网络服务交互、扫描内部资源，或访问外部无法直接访问的受限端点。 漏洞详情 CVE 编号： CVE-2026-37197 漏洞类型： 服务端请求伪造（SSRF） 厂商： VINADES JSC 产品...

CVE-2026-86259

CVE-2026-86259 - OpenMAIC 1.0.0: Fail-Openミドルウェアと環境変数で制御された検証バイパスによる、クラウドメタデータサービスへの未認証アウトバウンドSSRF 概要 検証済み。OpenMAICの認証ミドルウェアとアウトバウンドプロバイダーリクエスト層には、2段階のエクスプロイトチェーンが存在し、未認証のリモート攻撃者が一切の認証情報を持たずに、アプリケーションサーバーに任意のアウトバウンドHTTPリクエスト（169.254.169.254のクラウドInstance Metadata...

cve-2026-40072-ssrf-lab

CVE-2026-40072 SSRF ラボ web3.py の CVE-2026-40072 を実演し、Burp Suite で SSRF の影響を確認し、公式修正を検証するためのハンズオンローカルラボです。 概要 このリポジトリには、web3.py の CCIP Read / OffchainLookup 処理に関連するサーバーサイドリクエストフォージェリ SSRF の問題である CVE-2026-40072 の、安全なローカルのみの概念実証が含まれています。このラボでは、Kali Linux、Python 仮想環境、偽の内部サービスとしての Flask、そして送信リクエストを傍受す...

CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

CVE-2026-18424

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

CVE-2026-76820 OpenCTI: Synchronizer SSRF: stream fetch has no URL validation

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

CVE-2026-76820 OpenCTI: Synchronizer SSRF: stream fetch has no URL validation

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

EUVD-2026-79241

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

CVE-2026-76820

OpenCTI, an open-source cyber threat intelligence platform, is affected by a Server-Side Request Forgery (SSRF) in the synchronizerFetch GraphQL query prior to version 7.260701.0 . The backend's fetchRemoteStreams function validated only the HTTP/HTTPS scheme without applying the ingestion deny l...

EUVD-2026-79206

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery SSRF attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WA...

CVE-2026-76680 Authenticated Server-Side Request Forgery Vulnerabilities Leading to Information Disclosure in EdgeConnect SD-WAN Orchestrator

Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery SSRF attacks. A successful exploit allows an attacker to enumerate information about the internal structure of the EdgeConnect SD-WA...

CVE-2026-90971

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

CVE-2026-90971

A Server-Side Request Forgery (SSRF) vulnerability in the VMware synchronization feature of Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection defini...

CVE-2026-90971

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

CVE-2026-58485

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

CVE-2026-54688

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

CVE-2026-54689

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...