CVE-2026-108719

A flaw was found in LLMGateway. An authenticated remote attacker holding a valid API key can exploit a Server-Side Request Forgery SSRF vulnerability by supplying a loopback, private, or cloud metadata address as the video-generation callback URL. Because the application fails to validate the...

PT-2026-110122

Name of the Vulnerable Software and Affected Versions LLMGateway versions prior to 1.20.1 Description A blind server-side request forgery SSRF exists in the video-generation callback url extension. This issue allows API key holders to send Webhook POST requests to internal hosts, including...