CVE-2026-14540 Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox

A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...

PT-2026-66666

Name of the Vulnerable Software and Affected Versions Google mcp-toolbox versions 0.3.0 through 1.4.0 Description A Server-Side Request Forgery SSRF issue exists in the generic HTTP source and tool components. The HTTP client in internal/sources/http/http.go does not safely regulate request...

Server-Side Request Forgery (SSRF)

PowerJob is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of the targetIp and targetPort parameters in the checkConnectivity function of PingPongUtils, allowing attackers to trigger server-side network requests to arbitrary destinations...