EUVD-2026-58065

@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version 0.3.1, he network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows...

camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure

A flaw was found in the Apache Camel Vertx Websocket component. This vulnerability allows an unauthenticated remote attacker to inject malicious query parameters into a WebSocket connection. This can lead to Server-Side Request Forgery SSRF, where the server is coerced into making requests to...

CVE-2026-49857

auth-fetch-mcp has an SSRF protection bypass via IPv4-mapped IPv6 loopback. The root cause is in isPrivateV6() handling of hex-normalized IPv4-mapped addresses; input like http://[::ffff:127.0.0.1]:PORT/ becomes http://[::ffff:7f00:1]:PORT/ and net.isIPv4 returns false, allowing requests to priva...

CVE-2026-49857 auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

EUVD-2026-58054

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

CVE-2026-49857 auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

CVE-2026-49857

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

CVE-2026-66704

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

CVE-2026-66654

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-66704 WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

CVE-2026-66704

CVE-2026-66704 affects the WordPress Gutenverse Companion plugin, version

EUVD-2026-57907

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

CVE-2026-66704

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

CVE-2026-66654

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

EUVD-2026-57893

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-66654

CVE-2026-66654 : A Subscriber Server-Side Request Forgery (SSRF) vulnerability affects WordPress Vehica Core plugin (versions

CVE-2026-66654 WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...

CVE-2026-49478

Fulcio (certificate authority for OpenID Connect) reports a vulnerability in OIDC discovery across versions up to 1.8.5 where cross-host redirects attach Kubernetes ServiceAccount tokens, enabling blind SSRF, JWKS key substitution/poisoning, and potential leakage of tokens to external hosts. The ...

CVE-2026-49478

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind...