SSRF
Monthly
Authenticated blind server-side request forgery in Tandoor Recipes before 2.6.10 allows a user with privileges to create a Space and configure an AI provider URL to force the server to connect to arbitrary internal addresses. The AI actions behind TARGET/api/ai-import/ and api/ai-step-sort/ pass the attacker-supplied provider URL straight to LiteLLM, bypassing the application's safe_request outbound filtering, and the resulting connection success, refusal, or timeout is surfaced as a reachability oracle that can be used to map internal hosts, ports, and cloud metadata endpoints. Exploitation requires an authenticated account (PR:L) and the AI provider feature to be in use, and exposure is limited to a blind oracle rather than confirmed response-body exfiltration; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Server-side request forgery in Chaskiq through 2.0.3 allows unauthenticated attackers to make the server fetch arbitrary URLs-including internal network resources and cloud instance metadata endpoints-by submitting crafted requests to the createUrlUpload GraphQL mutation. The fetched content is stored as an ActiveStorage blob and returned to the attacker, enabling exfiltration of sensitive data such as IAM credentials from IMDSv1 endpoints. With a CVSS 9.2 severity and no authentication required, this is a high-priority issue; at time of analysis, no public exploit code was identified, though a technical writeup is publicly available. Note: confirmed actively exploited (CISA KEV) is not applicable; no public exploit identified at time of analysis.
Server-side request forgery in Wegow's ticket sales chart PDF export allows an authenticated promoter to inject malicious SVG content into the export request, causing the third-party Highcharts cloud service to fetch attacker-controlled external resources and embed the responses in the generated PDF. This provides a request proxying/laundering capability constrained to what the external SaaS can reach, and no public exploit has been identified at time of analysis. The CVSS 4.0 base score is 7.1 (High), driven almost entirely by high integrity impact (VI:H) while confidentiality and availability impacts are none, an unusual weighting for an SSRF which more typically carries a confidentiality impact.
Server-side request forgery in JobOps through 0.13.1 lets a caller submit an arbitrary url value to the POST /api/manual-jobs/fetch handler and have the server fetch internal destinations, with the response body returned to the caller, exposing loopback services, private-range hosts, and cloud instance metadata such as the 169.254.169.254 endpoint. In a standard deployment the request must carry valid authentication (PR:L per the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), but when the instance is running in demo mode unauthenticated clients can trigger the identical request, which is the configuration that removes the authentication barrier. Impact is confidentiality-only at 7.1 (no integrity or availability effect, no user interaction), and exploitation succeeds only if the target internal destination is network-reachable from the JobOps server; no public exploit code was identified at time of analysis, although a public technical writeup describing the flaw exists, and no KEV listing appears in the provided intelligence.
Server-side request forgery in PhastPress affects WordPress sites running the optional PhastPress performance plugin through version 3.10, allowing unauthenticated remote attackers to make the server fetch arbitrary URLs by spoofing the HTTP Host header. Because the plugin builds its scripts-service URL whitelist from that attacker-controlled header, no login, user interaction, or non-default configuration is required; impact is limited to the response data and any reachable internal or external services the WordPress host can access. No public exploit identified at time of analysis, and EPSS is not supplied in the source data, so this is a genuine but not top-priority SSRF risk pending patch adoption.
Unauthenticated XML External Entity (XXE) injection in Ellucian WebAdvisor 3.2 lets remote attackers POST crafted XML to the /WebAdvisor/WebAdvisor endpoint and abuse an XML parser that has external entity and DTD resolution left enabled, yielding server-side request forgery, coerced NTLMv2 hash disclosure to an attacker-controlled SMB share, and arbitrary file read from the underlying Windows host through an out-of-band error-based channel. No authentication or user interaction is required (CVSS vector shows AV:N/PR:N/UI:N), and impact is confined to confidentiality with no integrity or availability effect; the vendor-published CVSS 4.0 score is 8.7 while our independent assessment rates the same vector as high confidentiality impact only. No public exploit code has been identified at time of analysis, and real-world exposure is limited to legacy higher-education deployments because WebAdvisor reached end-of-support in June 2022.
Server-side request forgery in Renovate before 44.79.0 allows authenticated users with low privileges to direct the shared HTTP client at arbitrary internal URLs through 'extends' preset references or 'customDatasources' entries. An attacker who can influence Renovate's configuration - for example by committing to a scanned repository or controlling a preset source - can reach an instance metadata endpoint such as AWS IMDS to obtain credentials, or exfiltrate sensitive information into Renovate logs; real-world impact depends on the deployment's network reachability of internal services. The vendor fixed the issue in Renovate 44.79.0, and no public exploit code has been identified at time of analysis.
Memory exhaustion and limited configuration-resource disclosure affect OmniFaces (maven/org.omnifaces:omnifaces) before 1.14.3, 2.7.33, 3.14.23, 4.7.12 and 5.4.2 because CombinedResourceHandler accepts a structurally valid deflated, base64-encoded combined-resource ID without verifying the server issued it. A remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 8.2) who reaches a JSF application that has opted into the resource-combining handler can inflate a forged ID with roughly 770:1 amplification (about 20 KB input expanding to ~16 million characters, ~49 MB heap delta), add unique reconstructed IDs to a process-lifetime cache with no eviction, and read Facelets source from the webapp resource tree or META-INF/resources because jakarta.faces.RESOURCE_EXCLUDES is not applied on this custom resolution path. The advisory documents in-lab reproductions of these behaviors (including a blind, deployment-dependent server-side fetch when the non-default wildcard CDN mapping and an omnifaces.graphic inner resource are in play), but this is not confirmed as actively exploited and is not listed in CISA KEV; no public exploit code was identified at time of analysis.
TurboDocx html-to-docx through 1.23.1 is vulnerable to server-side request forgery (CWE-918): when an application converts attacker-supplied HTML to DOCX with remote image handling enabled, the library dereferences <img src> URLs server-side, and a loose isValidUrl() check allows loopback, RFC1918 private, and cloud metadata addresses (e.g. 169.254.169.254) to be requested and their responses embedded into the generated document's word/media folder. The flaw is remotely reachable without authentication or user interaction (CVSS:4.0 PR:N/UI:N, 8.2; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), and publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing) and no vendor-released patch identified at time of analysis. Real-world risk is conditional rather than universal: the attacker must supply a live, responsive internal target, the fetched response must be readable from the returned DOCX, and deployments that disable remote image fetching, filter outbound traffic, or restrict HTML input are not exploitable.
Directive injection in NGINX Gateway Fabric lets an authenticated namespaced tenant escape the auth_basic "<realm>"; quoting rendered into a shared data-plane nginx.conf and inject arbitrary NGINX directives. Exploitation requires a multi-tenant deployment in which several namespaces share one Gateway/data plane, plus namespaced RBAC to create an AuthenticationFilter CRD and attach it via spec.basic.realm or spec.jwt.realm to an HTTPRoute or GRPCRoute bound to that Gateway (CVSS vector shows PR:L and UI:N, so valid authenticated credentials are required and no user interaction is needed). The impact is control-plane only, with no data-plane exposure, but a successful attacker could read co-located tenants' mounted secrets, perform SSRF through proxy_pass, read the pod ServiceAccount token, or hijack other tenants' routes; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Unauthenticated server-side request forgery in Kan 0.5.5 through 0.6.0 allows remote attackers to make the server issue arbitrary outbound HTTP requests through the /api/download/attatchment route by supplying a crafted url query parameter. The flaw is an incomplete fix for CVE-2026-32255 and only manifests when the S3_ENDPOINT environment variable is unset or blank - the configuration the project's own .env.example documents as the intended setup for AWS S3 - in which case hostname validation is skipped entirely and the attacker-controlled URL is handed directly to fetch(). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but EPSS/scoring data and the unauthenticated network vector (CVSS 4.0 base 9.2, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) make this a high-priority fix for exposed deployments.
Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote attackers to induce the server to make arbitrary outbound requests, potentially reaching internal services and escalating privileges. The CVSS 3.1 base score is 8.6 (HIGH) with a changed scope, high confidentiality impact, and no integrity or availability impact. Exploitation requires no user interaction; no public exploit code has been identified at time of analysis, and the vendor advisory APSB26-163 should be consulted for fixes.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows an authenticated low-privileged attacker to coerce the application server into issuing requests to internal resources, yielding elevated access and disclosure of data outside the attacker's intended scope. Adobe assigns this a CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N); exploitation is non-deterministic because the vendor states success depends on conditions beyond the attacker's control, and it requires an existing foothold as a low-privileged account. There is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk profile is that of a moderate-severity, post-authentication SSRF rather than a remotely exploitable unauthenticated flaw.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a high-privileged ColdFusion account force the server to issue requests to internal or otherwise restricted resources, resulting in privilege escalation and unauthorized access to internal services. The vulnerability is network-reachable (AV:N), needs no user interaction (UI:N), but is gated by the high-privilege precondition (PR:H), so it is not exploitable against default unauthenticated configurations - the practical risk is concentrated on internet-exposed ColdFusion administrative interfaces and insider or post-compromise scenarios. The CVSS vector changes scope (S:C), meaning the attacker can leverage the vulnerable ColdFusion component to affect resources outside its own security authority, and no public exploit code has been identified at time of analysis. This is a solid-priority-but-not-emergency issue rather than an emergency, driven mainly by the privileged access required to trigger it.
Server-side request forgery in Adobe ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13) lets unauthenticated, network-reachable attackers coerce the server into issuing arbitrary outbound requests, with the changed scope (S:C) allowing those requests to pivot into back-end or cloud services that can confer elevated privileges. Rated CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, CWE-918), the flaw requires no authentication and no user interaction per the vector, but real-world data exposure depends on the ColdFusion instance having reachable internal targets such as cloud metadata endpoints or internal APIs. No CISA KEV listing and no public exploit code were identified at time of analysis, yet the default-configuration exposure of affected versions makes prompt patching advisable.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a low-privileged authenticated attacker to make the ColdFusion server issue requests to internal or otherwise restricted resources, potentially escalating access and reading sensitive data. The vulnerability is rated CVSS 3.1 7.7 with scope changed and high confidentiality impact only; authentication as a low-privileged user is required (PR:L), no user interaction is needed, and no public exploit code was identified at time of analysis.
Server-side request forgery in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows unauthenticated remote attackers to cause the server to make arbitrary requests, resulting in privilege escalation with the scope changed. This critical vulnerability has a CVSS score of 10.0 and requires no user interaction. No public exploit has been identified at the time of analysis.
Server-side request forgery in Adobe ColdFusion lets remote unauthenticated attackers force the server to issue requests to internal or otherwise protected endpoints, which Adobe flags as potentially escalating privileges across a security boundary. The affected builds are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) confirms no user interaction and no authentication prerequisite, with confidentiality being the only impact dimension assessed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, so risk derives from high internet/network exposure of affected builds rather than confirmed active exploitation. Real-world severity hinges on what the ColdFusion host can reach internally, since a scope-changed SSRF that touches cloud metadata services or internal admin APIs can yield credential material even without an integrity or availability impact.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privileged user on the target farm coerce the server into issuing requests to attacker-influenced destinations, which Microsoft rates as a network-vector privilege elevation (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not trivial: the assessed conditions require a valid low-privileged account (PR:L) plus environmental factors captured by AC:H - a reachable internal target, specific server configuration, and/or timing and state dependencies that the attacker does not fully control. Only SharePoint Server Subscription Edition builds 16.0.0 below 16.0.20326.20190 are affected, no user interaction is needed (UI:N), no public exploit was identified at time of analysis, and CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is a real but non-urgent patching priority rather than an emergency.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition (on-premises builds 16.0.0 below 16.0.20326.20190) lets an authenticated, low-privilege user coerce the SharePoint server into issuing HTTP requests to internal or otherwise unreachable endpoints, producing high confidentiality, integrity and availability impact and enabling privilege elevation over the network. The issue is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so an existing authenticated account is required and additional server-side conditions must be satisfied for the forgery to succeed, which materially limits reliability. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and Microsoft has published a vendor-released fix, making this a genuine but moderate-priority issue rather than a drop-everything emergency.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker with low privileges force the SharePoint application server to issue crafted requests on their behalf, which can expose sensitive internal resources and, per Microsoft's rating, enable privilege elevation over a network. The affected builds are SharePoint Server Subscription Edition versions earlier than 16.0.20326.20190, and exploitation requires network access plus a valid low-privileged account while also requiring attack-specific conditions that Microsoft captures as high complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5). CISA's SSVC decision data records Exploitation: none, Automatable: no, and Technical Impact: total, so no public exploit code or in-the-wild activity is identified; the impact is nonetheless potentially total against confidentiality, integrity, and availability once the request-forgery primitive is chained successfully, and a vendor patch is available. This is a moderate-priority vulnerability that does not currently rise to emergency status.
Finsys Dockhand before 1.0.43 turns authenticated stack-template submission into a server-side data-theft primitive: an attacker-supplied repository URL or stackfile value is fetched by the server and the fetched body is echoed back in the compose response field, so internal services and cloud instance-metadata endpoints can be read directly rather than probed blindly. Any holder of a valid Dockhand account with the ability to create or submit stack templates to the API compose endpoint can exploit this, and the impact grows sharply where the instance has reachable IMDS or sensitive internal services on its network. No public exploit code was identified at time of analysis, and the vendor has released version 1.0.43 as the fix; the 8.4 score reflects high confidentiality impact tempered by the requirement for an authenticated account.
Kubeflow Model Registry through 0.3.17 allows an authenticated namespace user with permission to create InferenceService resources to steal the InferenceService controller's ServiceAccount bearer token. The attacker creates an InferenceService with the modelregistry.kubeflow.org/url annotation pointing to an attacker-controlled server; the controller follows the annotation and attaches its token, which the attacker captures and then uses to modify other tenants' InferenceServices cluster-wide. This is a server-side request forgery (CWE-918) requiring low privileges (PR:L) and no user interaction; no public exploit code was identified at time of analysis, and no CISA KEV entry exists.
Unauthenticated resource exhaustion and outbound request amplification in Misskey's fetch-rss API affect versions 12.112.1 through releases prior to 2026.7.0. Any remote attacker can repeatedly call the publicly reachable endpoint, which in affected versions had no rate limiting, no response-size cap, and no concurrency bound, forcing the instance to open unbounded outbound HTTP connections and perform synchronous XML parsing; this drains instance CPU, memory, and socket resources, can be used as an amplification vector against third-party servers, and can probe network-reachable services even when federation is disabled. CVSS 4.0 scores the flaw 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N, high availability impact with limited scope change), no public exploit code or CISA KEV entry was identified at time of analysis, and the issue is fully remediated by upgrading to 2026.7.0.
Unauthenticated remote attackers can abuse NVIDIA AIStore's experimental HT backend to perform server-side request forgery by supplying a crafted 'original URL' value, causing the AIStore server to issue requests to attacker-chosen destinations and disclose information reachable from the server's network position. The flaw carries a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting no authentication or user interaction requirement and a scope change, with impact confined to confidentiality - integrity and availability are unaffected. There is no public exploit identified at time of analysis, and the practical risk is gated almost entirely on whether the experimental HT backend has been enabled on a network-exposed deployment, since that component is not part of the default AIStore configuration and is only reachable in non-standard setups.
Server-side request forgery in NVIDIA AIStore for Linux's distributed sort (dsort) component allows remote unauthenticated attackers to make an AIStore node issue outbound HTTP requests to an arbitrary URL by supplying a crafted external key map URL, resulting in disclosure of information from internal or otherwise unreachable services. The CVSS 3.1 base score is 8.6 (High) via AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, meaning the attack is network reachable, low complexity, requires no privileges and no user interaction, with the impact limited to confidentiality (integrity and availability are unaffected). At time of analysis no public exploit code has been identified, there is no CISA KEV listing for this CVE, and no EPSS score was supplied in the available data.
Server-side request forgery in the SAP Cloud SDK for Python lets remote, unauthenticated attackers redirect OAuth2 token requests to a server they control by manipulating the tenant_subdomain value used to build the token endpoint URL, resulting in exfiltration of the application's OAuth2 client credentials. Exposure is limited to multi-tenant SAP BTP applications that use the SDK for OAuth2 token acquisition and allow attacker influence over the tenant_subdomain input; single-tenant deployments, or those that do not derive the token URL from attacker-supplied data, are not exposed. The vulnerability carries a maximum-severity score of CVSS 10.0, and no public exploit code was identified at time of analysis; no confirmed actively exploited (CISA KEV) status applies.
Authenticated users of the Red Hat OpenShift web console can abuse the Helm chart URL input to make the console pod issue requests to arbitrary destinations, turning the console into a Server-Side Request Forgery (SSRF) proxy (CWE-918, CVSS 3.1 base 7.7). Because the console pod typically sits inside the cluster network with broader reachability than the user, a low-privileged console account with the ability to add or load a Helm chart can use leaked error output to read sensitive responses and can perform blind port scanning against internal services. Exploitation requires an authenticated console session and the privilege to supply a chart repository URL (PR:L, unauthenticated outsiders cannot reach it), and the assessed impact is confidentiality-only with no integrity or availability effect; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Unauthenticated remote attackers can exploit deprecated OpsDirector functionality in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 to perform server-side request forgery (SSRF), making unauthorized requests to internal services or forging trusted requests that may expose protected information. Exploitation is conditional on the OpsDirector component being present and network-reachable; no public exploit code has been identified at time of analysis. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability impact.
Server-side request forgery in Linux-based Progress MarkLogic Server 11.x and 12.x allows an authenticated, low-privileged user to coerce the database server into making HTTP requests toward internal endpoints reachable from its network position, which in cloud-hosted deployments can expose instance metadata services and the cloud credentials they hold. Exploitation requires valid low-privilege credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) plus a deployment where an internal metadata or credential service is actually reachable, so on-premises or otherwise isolated installations gain no credential-theft payoff and no unauthenticated path exists. Only releases before 12.1.0 (12.x) and before 11.3.7 (11.x) are affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7) when hosted on Microsoft Azure lets an authenticated attacker induce the server to issue requests against internal cloud services, potentially exposing Azure credentials or tokens. The flaw carries a CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), reflecting a scope change into the cloud control plane and high confidentiality impact; exploitation requires a valid low-privileged MarkLogic account and an Azure deployment, so on-premises and non-Azure instances are outside the described scope. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the highest-value outcome for an attacker is credential or token theft rather than code execution or denial of service.
Server-side request forgery in Crawl4AI (unclecode) versions 0.7.0 through 0.9.3 lets unauthenticated, remote API clients force the crawler to fetch internal, private, and cloud-metadata URLs and hand back the parsed head data of those responses. The attack abuses the optional link_preview_config on /crawl requests: an attacker submits a page they control with include_external and include_patterns enabled, and the AsyncUrlSeeder component then follows links pointing at internal services or the cloud instance metadata endpoint. Exploitation requires the non-default link_preview_config feature to be active and the /crawl API to be network-reachable; the CVSS vector (PR:N, UI:N) indicates no authentication or user interaction is needed once those conditions hold. No public exploit code has been identified at time of analysis, and the issue is rated 9.2 under CVSS 4.0 (independent assessment: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), making this a genuinely high-priority flaw for affected deployments.
Server-side request forgery in the Builderius WordPress plugin (versions 1.4 through 1.4-beta) lets an attacker drive the affected site to make arbitrary outbound HTTP requests, potentially reaching internal services, localhost, and cloud instance metadata endpoints. Our independent assessment scores this as network-reachable, low-complexity, and requiring low-privileged authenticated access (PR:L, base 7.2 HIGH), while the vendor-supplied vector claims unauthenticated access (PR:N) that remains unverified; comparable WordPress plugin SSRFs in practice often require a logged-in user. Impact is limited to low confidentiality and integrity with a scope change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated server-side request forgery in the StreamCast WordPress plugin (versions 2.4.5 and earlier, published by Bplugins) lets a remote attacker coerce the affected WordPress site into issuing attacker-chosen outbound HTTP requests to internal, loopback, or otherwise non-public hosts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) indicates exploitation requires only network reachability of the plugin endpoint on a default installation - no credentials, no user interaction - with the scope change reflecting impact on systems beyond the WordPress instance itself, though the low confidentiality and integrity ratings mean the practical payoff is internal reconnaissance and limited data disclosure rather than full site compromise. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV); real-world attack value depends heavily on what internal services, control-plane APIs, or cloud metadata endpoints the target web server can actually reach.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already holds high-privilege (administrative) credentials to coerce the appliance into issuing requests to attacker-chosen destinations, causing information disclosure, unauthorized access, and bypass of protection mechanisms (CWE-918; CVE-2026-78024). The scope-change metric (S:C) indicates forged requests can affect systems beyond the vulnerable component, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N confirms the exploitation prerequisite is authenticated administrator access - this is the primary limiting factor and means unauthenticated or low-privileged remote users cannot trigger it. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA KEV: no; SSVC exploitation: none), EPSS is only 0.20% (9th percentile), and a vendor patch is available, so this ranks as a moderate, non-urgent priority despite its 8.7 'High' base score.
Privilege escalation in Microsoft Azure SRE Agent lets an authenticated, low-privileged user exploit a missing authorization check in a server-side request-forwarding (SSRF) path to reach resources and act with the agent's higher-privileged identity, yielding high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Because the flaw sits in a Microsoft-managed cloud service, no customer-side configuration is required to trigger it - the only real gate is that the attacker must already hold a valid, authorized low-privileged identity in the service (PR:L, matching the advisory's 'authorized attacker' wording). Risk signals are moderate rather than urgent: EPSS is 0.39% (31st percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis; a vendor patch is available per Microsoft's advisory.
Unauthenticated server-side request forgery and missing authorization in Dromara Skyeye let remote attackers drive the server to fetch attacker-chosen internal URLs and overwrite any user's stored file through the OnlyOffice save callback editUploadOfficeFileById, then retrieve the modified content via queryFileToShowById. The flaw carries a CVSS 4.0 base score of 9.1 (PR:N, UI:N), although the assessed high attack complexity (AC:H/AT:P) reflects that a valid file id/key and an active OnlyOffice document-editing/callback flow are likely prerequisites, and SSRF reach is bounded by what internal addresses the server can resolve. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis.
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to force the server to download arbitrary URLs via the unmodified upstream FilePond PHP fetch API route, then read back the fetched content through the transfer directory. The flaw, identified as CWE-918, affects Malcolm deployments using the file-upload feature and can expose internal network services or cloud metadata due to curl's FOLLOWLOCATION behavior. No public exploit identified at time of analysis; exploitation requires access to the upload endpoint (PR:L), and impact is limited to confidentiality readback plus minor availability (storage consumption).
Unauthenticated server-side request forgery (SSRF) in the Cisco Finesse web-based management interface lets remote attackers send crafted HTTP requests that cause the device to make requests to associated services, potentially exposing limited sensitive information. The flaw is caused by improper input validation for specific HTTP requests and requires network reachability to the management interface but no credentials or user interaction; CVSS 3.1 score is 7.2, driven largely by scope change rather than severe direct impact. No public exploit identified at time of analysis.
Pre-authentication server-side request forgery in the SonicWall SMA1000 Appliance's Work Place interface lets a remote attacker who can reach the appliance abuse an unintended alternate access path that bypasses authentication and coerce the device into issuing requests on the attacker's behalf, reaching internal functionality that is not otherwise exposed externally (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - high confidentiality impact, low integrity impact, no availability impact). Affected builds are SMA1000 12.4.3-03526 (platform-hotfix) and older, and 12.5.0-02952 (platform-hotfix) and older; because the Work Place portal is normally internet-facing on these remote-access appliances, exposure is broad and this is a genuine top-priority vulnerability rather than a high-CVSS-but-low-risk artifact. No public exploit identified at time of analysis, and exploitation requires only default network reachability with no credentials and no user interaction, so the practical impact is bounded mainly by which internal services the appliance can reach through the forged requests.
Server-side request forgery in Gitea 1.27.3 and earlier lets a user who can start a repository migration or mirror reach blocked internal addresses: Gitea validates the destination hostname against its egress allow/block lists before invoking Git, but the Git subprocess resolves the hostname independently when it actually connects, so an attacker who controls the destination's DNS can re-point the name from an allowed address to an internal one between validation and connection. Exploitation requires both the ability to initiate a migration (on a default install this means a logged-in account, and instances with open registration make it effectively unauthenticated) and control of authoritative DNS with suitably short TTLs, which is why the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N rather than the vendor's 7.5. No public exploit code has been identified at time of analysis, EPSS is only 0.15% (3rd percentile), and SSVC records Exploitation: none with partial technical impact; the vendor-released fix is Gitea 28.0.0.
Server-side request forgery in Gitea (versions up to and including 1.27.3) lets a repository administrator bypass the configured outbound host policy: Gitea validates the initial remote URL for push mirrors, wiki remote checks, and migrated pull-request heads, but the raw Git operation that follows will chase an HTTP redirect to an address the policy would otherwise block, causing the server's Git client to reach internal services. Exploitation is meaningfully constrained - it requires repository-administrator privileges, a restrictive egress allow-list must actually be configured, and the attacker must control or locate an allow-listed endpoint that redirects to the desired internal target - so the realized impact is bounded by which internal services are reachable from the Gitea host. EPSS is 0.15% (3rd percentile), no public exploit identified at time of analysis, and there is no CISA KEV listing, so exploitation appears opportunistic and low-volume rather than confirmed actively exploited. Note that the published CVSS vector (7.5, PR:N) overstates the privilege requirement; our assessment rates it PR:L with limited confidentiality and integrity impact.
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0 through 1.15.4) lets an authenticated user who controls a TechDocs source repository have documentation builds fetch and publish content from network locations reachable by the build environment. The issue is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting a confidentiality-only, scope-changing impact that requires repo write access and a build topology where internal endpoints are reachable without token or special-header protections; newer cloud metadata services that require tokens or custom headers are explicitly not directly accessible. Vendor-released patches exist in @backstage/plugin-techdocs-node 1.14.7 and 1.15.5 (and in Backstage releases v1.50.6, v1.54.8, v1.55.0); no public exploit identified at time of analysis.
Server-side request forgery in GitHub Enterprise Server 3.20, 3.21, and 3.22 lets an authenticated repository contributor with push permission cause the appliance to issue requests to attacker-controlled internal hosts, which can be chained to remote code execution on the appliance. The flaw sits in the secret scanning validator for GCP service account credentials, which trusts the token endpoint embedded in a committed credential and sends a request to it without restricting the destination, and it additionally requires GitHub Advanced Security with secret scanning validity checks enabled, a non-default configuration. No public exploit identified at time of analysis; vendor-released patches are 3.20.9, 3.21.7, and 3.22.2, and the issue was reported through the GitHub Bug Bounty program.
Unauthenticated server-side request forgery in the Instapage WordPress plugin, affecting all versions up to and including 3.7.2, lets any remote attacker who can reach a vulnerable site make the web server issue requests to arbitrary internal or external destinations. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) confirms the attack is network-reachable, requires no credentials and no user interaction, and crosses a security scope boundary, though the Low confidentiality and Low integrity ratings indicate constrained response retrieval and limited write effects rather than full data exfiltration. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and no EPSS or KEV data was supplied; this is a medium-to-high severity, lower-urgency issue whose practical impact depends on what internal services, cloud metadata endpoints, or trusted-network resources are reachable from the affected web server.
Unauthenticated server-side request forgery in the WordPress plugin PDF Smart Viewer for Elementor (versions 1.0.4 and earlier) lets any remote attacker induce the affected site's server to fetch an arbitrary URL of the attacker's choosing, with no authentication (PR:N) and no user interaction (UI:N) required per the assessed CVSS vector. Because the scope is changed (S:C) but confidentiality and integrity impacts are bounded (C:L/I:L), a successful attack typically means using the WordPress host as a request proxy to probe or interact with internal-only services, loopback interfaces, or cloud instance metadata endpoints rather than direct compromise of the plugin itself. Only sites with the plugin installed and active, and whose PDF-fetching functionality is reachable, are exposed; no public exploit code was identified at time of analysis, and exploitation is not confirmed as active in the wild.
Server-side request forgery in Dify (LangGenius) before 1.13.0 allows unauthenticated remote attackers to make the Dify server fetch attacker-supplied URLs through the /console/api/remote-files/upload (POST) and /remote-files/<path:url> (GET) endpoints, turning the instance into a network pivot against internal services and cloud metadata endpoints. Rated CVSS 3.1 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L), the issue is unauthenticated by design - the fix adds @login_required - but practical exploitability is bounded by Dify's existing ssrf_proxy wrapper, which may filter internal or metadata targets depending on allowlist configuration. No public exploit code identified at time of analysis and no confirmed active exploitation; a vendor-released patch (1.13.0) is available.
Authenticated users who can create a workspace in Plane can force the application's background worker to fetch internal-only resources - including cloud instance metadata endpoints - by registering a webhook whose URL points at an attacker-controlled public host that returns a 302 redirect to a private, loopback, or link-local address. Because the pre-1.4.0 webhook delivery task calls requests.post() without disabling redirects and only validates the originally submitted URL, the fetched response body is written into webhook_logs and can be read back through the workspace webhook-logs API, turning the SSRF into a practical internal-data exfiltration channel. All Plane versions prior to 1.4.0 are affected; the issue is fixed in 1.4.0, no public exploit code has been identified at time of analysis, and exploitation requires authentication plus workspace-creation privileges rather than being anonymous.
Server-side request forgery in Plane (makeplane/plane) before 1.4.0 lets an authenticated user abuse the OAuth avatar synchronization flow to make the Plane server fetch internal-only resources and then retrieve the fetched bytes through the public /api/assets/v2/static/{asset_id}/ asset endpoint. The avatar_url value taken from the attacker's OAuth provider profile is fetched server-side without internal-IP validation and with redirects followed by default, so a public URL can be used to bounce the request to a cloud metadata service (169.254.169.254) or an internal admin API reachable from the Plane host. Vendor-released patch: 1.4.0 (advisory GHSA-cv9p-325g-wmv5); no public exploit identified at time of analysis. The exploitation conditions are real but conditional - OAuth-based authentication with avatar sync must be enabled and the server must be able to reach something sensitive internally - so cloud-hosted deployments are the most exposed, and this is a legitimate but conditional risk rather than a drop-everything emergency.
Server-side request forgery in the Plane project-management platform (makeplane/plane) prior to 1.4.0 allows any authenticated project member to make the server fetch attacker-chosen internal URLs during work-item link unfurling and read the response body back as the link title or favicon, producing a readable rather than blind SSRF. The vulnerable behaviour is a regression-style gap: the fix shipped in v1.2.2 for CVE-2026-27706 / GHSA-jcc6-f9v6-f7jw (also an SSRF in link unfurling) remains incomplete in the v1.3.1 GA release, so the v1.2.2 mitigation alone is not sufficient on that line. Rated CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), exploitation requires a low-privileged authenticated account, and no public exploit code has been identified at time of analysis; the highest-value outcome is theft of cloud IAM credentials by targeting the instance metadata endpoint at 169.254.169.254 on cloud-hosted deployments, where the link fetcher can reach internal metadata or internal-only services.
Server-side request forgery in Plane, the open-source project management tool, allows a low-privilege user of a connected Gitea instance to make the Plane server issue HTTP requests to internal or private addresses. The flaw affects versions prior to 1.4.0 and only manifests when an administrator has explicitly enabled Gitea OAuth and pointed GITEA_HOST at a legitimate Gitea deployment (the feature is off by default); an authenticated Gitea user then sets an internal URL as their profile avatar and logs in through OAuth, causing Plane to fetch that attacker-chosen target without validation. The result is a largely blind SSRF primitive, since the avatar handler only accepts image Content-Types and enforces a size cap, and no public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in self-hosted Plane (makeplane/plane) versions prior to 1.4.0 lets an authenticated workspace administrator who can create or edit webhooks point a webhook at an attacker-controlled hostname and then rebind that hostname to an internal IP address, causing the background delivery worker to issue requests against internal services, cloud metadata endpoints, or other hosts reachable from the API/worker containers. The flaw is a bypass of the earlier SSRF fix for CVE-2026-30242: creation-time IP validation is performed in apps/api/plane/app/serializers/webhook.py, but apps/api/plane/bgtasks/webhook_task.py independently re-resolves the hostname at send time without validating the result, leaving a DNS-rebinding TOCTOU gap. Per the assessed CVSS 3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N (base 7.6), exploitation demands high administrative privilege and a successfully won DNS race, but yields high confidentiality impact and scope change; no public exploit code has been identified at time of analysis and the issue is fixed in Plane 1.4.0.
Server-side request forgery in Eclipse Che 7.29.0 and later allows any authenticated low-privilege user to make the workspace server fetch attacker-chosen URLs through the GET /api/scm/resolve and POST /api/factory/resolver endpoints, which pass the URL to URLFetcher.fetch() without any scheme or host allow-list. Successful abuse yields high confidentiality loss: arbitrary local file reads inside the Che pod (notably the Kubernetes service-account token at file:///var/run/secrets/kubernetes.io/serviceaccount/token), access to internal HTTP services and cloud instance metadata at 169.254.169.254, and delivery of the victim's stored SCM personal access token as an Authorization header to a host of the attacker's choosing; integrity impact is more limited, largely the unauthorized use of forwarded credentials. No vendor-released patch was identified at time of analysis and no public exploit code was identified at time of analysis, though the affected code paths are reachable by any authenticated user. A second, interaction-dependent variant triggers the credential forwarding when a victim opens a workspace from a malicious devfile whose parent.uri points at an attacker-controlled server.
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Server-side request forgery in Feehi CMS 2.1.1 allows remote attackers to coerce the server into issuing HTTP requests to attacker-chosen URLs via the bundled UEditor 'catchimage' image-fetch endpoint, because the private-IP validation routine fails to block loopback (e.g. 127.0.0.1) and link-local (e.g. 169.254.169.254) destinations. The SSRF is semi-blind - the attacker infers internal service state through observable response differences rather than receiving full response bodies - so practical impact is limited to internal service probing and information disclosure, with no confirmed integrity or write effect; the supplied vector rates it 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), while the independent assessment downgrades confidentiality to Low (C:L) and notes that PR:N is unverified because catchimage may sit behind an authenticated CMS session. Publicly available exploit code exists (SSVC Exploitation: poc) and the issue is automatable, but there is no confirmed active exploitation (not in CISA KEV), and the EPSS score is low at 0.14% (3rd percentile), indicating limited near-term exploitation likelihood at scale.
Server-side request forgery in Loom for AWS before 1.7.0 lets an authenticated user with privileges to register, update, or test a tool server or remote agent (the MCP Server / A2A Agent integration feature) supply a crafted connection address that the backend fetcher follows and whose response body it echoes back, exposing the application container's own IAM role credentials and responses from arbitrary internal network locations. Exploitation requires a high-privileged authenticated account (CVSS PR:H) and is only meaningful where the container runs with a role worth stealing; there is no anonymous or pre-authentication path, and no public exploit identified at time of analysis. Deployments on or upgraded to 1.7.0, which adds IP-validated, DNS-pinned fetchers and connection-sink guards, are not affected.
Server-side request forgery in the OAuth2 discovery handling of Loom for AWS (awslabs/loom) before 1.7.0 lets an authenticated user who can register a tool server or remote agent supply a crafted discovery document address, causing the backend to make requests to arbitrary internal network locations and - in deployments using delegated authentication - to leak another user's access token. The prerequisites are meaningful: the attacker needs high privileges to register the tool server/remote agent (PR:H) and the token-disclosure outcome requires passive interaction from a victim user (UI:P), so this is a credible, above-average-priority issue rather than an emergency, and it only affects deployments actually using the OAuth2/OIDC delegated-authentication discovery feature. There is no public exploit identified at time of analysis; the vendor has released Loom 1.7.0, which adds a deployment-trusted issuer host requirement before any token exchange and applies an IP-validated, DNS-pinned fetcher to all outbound OAuth2/OIDC calls.
Improper restriction of XInclude resource resolution in Copernik XML Factory through 0.1.1 allows an attacker-controlled XML document to resolve xi:include hrefs when the stock JDK provider is in use, resulting in local file disclosure and server-side request forgery against internal HTTP endpoints. Only applications that obtain a factory from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory() (or harden an externally supplied XMLReader via XmlFactories.harden()), run without Apache Xerces (xercesImpl) on the classpath, explicitly enable XInclude with setXIncludeAware(true) or the equivalent reader feature, and parse XML from an untrusted source are affected; the Xerces provider and the Android provider are not affected. No CVSS vector, EPSS score, or CISA KEV entry was provided, so no public exploit or active exploitation was identified at time of analysis, although the defect is confirmed and fixed by upstream commits and the 0.1.2 release.
Server-side request forgery in the Next.js Image Optimization endpoint lets a remote, unauthenticated attacker cause the server to fetch images from private or internal IP addresses, but only in applications that have configured images.remotePatterns. Affected releases are Next.js 16.0.0 through 16.3.7; the flaw is fixed in 16.3.8 by pinning the outbound connection to the DNS addresses that were already validated against the allow-list. Exploitation is not deterministic - the attacker must win a timing race between the allow-list check and the socket's own DNS lookup (DNS rebinding), consistent with the high attack-complexity rating - and no public exploit code has been identified at time of analysis (EPSS/KEV signals were not provided).
Server-side request forgery in YesWiki before 4.6.7 allows unauthenticated remote attackers to force the server to issue arbitrary GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action, with fetched responses stored back as readable Bazar entries. The CVE carries a CVSS 4.0 base score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N, high confidentiality impact, low integrity and availability impact), matching our independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - no special privileges or user interaction are required, only network reachability to an instance running a vulnerable version that exposes the sync action. Impact is highest where the YesWiki host sits adjacent to internal services or a cloud metadata endpoint, and no public exploit code has been identified at time of analysis; the issue is not listed as confirmed actively exploited (CISA KEV).
Server-side request forgery in YesWiki versions before 4.6.7 allows unauthenticated remote attackers to make the server issue blind GET and POST requests to internal hosts or cloud metadata endpoints by sending signed Follow activities to the public forms actor ActivityPub inbox. The attacker signs each request with their own keyId and places an internal actor URL in the ActivityPub body, so no victim credentials are required, but the attack succeeds only when the ActivityPub handling path processes the signed activity and a useful internal target is reachable. A vendor patch is available in 4.6.7; no public exploit was identified at time of analysis, and the independent assessment rates this as a moderate priority because reliability is constrained and confidentiality impact depends on cloud or segmented network exposure.
Server-side request forgery in YesWiki before 4.6.7 lets unauthenticated attackers reach internal services and cloud metadata endpoints by sending a crafted ActivityPub Signature keyId whose URL is expressed as an IPv6 transition address (6to4, NAT64, or IPv4-compatible IPv6), evading validateKeyIdUrl()'s SSRF guard. Exploitation requires the public federation actor-inbox route to be reachable by the attacker and involves non-trivial payload crafting, consistent with the independent assessment of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N; no public exploit identified at time of analysis. Real-world impact depends heavily on what the YesWiki server can reach internally - cloud metadata (169.254.169.254), loopback services, or internal hosts make it serious, while instances without reachable internal targets yield little value.
Full-read server-side request forgery in GetSimple CMS CE versions prior to 1.5 allows an authenticated attacker with access to the update handler form to make the server fetch arbitrary URLs and read the response body back from a web-accessible file. The handler applies only FILTER_VALIDATE_URL format checking with no destination or scheme allowlisting, so requests can be aimed at internal-only services and cloud metadata endpoints such as 169.254.169.254, with the fetched body written to /Tmpfile.zip and left in place even when it is not a valid ZIP. Exploitation requires high privileges (CVSS PR:H) and the installed version must be below 1.5; publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and vendor-released patch 1.5 is available.
Server-side request forgery in Vvveb CMS builds prior to 1.0.8.6 allows an authenticated admin-panel user (default role site_admin or higher) to make the editor's oEmbed proxy fetch attacker-chosen URLs server-side and read the reflected response body, exposing internal-only HTTP services and cloud metadata endpoints including IAM credentials. The bypass works because Vvveb's SSRF guard resolves hosts with an IPv4-only function, so a bare IPv6 literal or a domain publishing only an AAAA record never matches the private-range check, while hosts with an A record remain blocked. Exploitation is access-gated by the PR:H requirement and by whether the deployment actually exposes reachable internal services or a metadata endpoint; no public exploit identified at time of analysis. The issue is patched in 1.0.8.6.
Server-side request forgery in Budibase through 3.41.0 allows an authenticated builder-level user to make the server fetch arbitrary internal URLs and read the response back through the AI table generation endpoint (POST /api/ai/tables). The uploadUrl helper in packages/server/src/utilities/fileUtils.ts calls raw node-fetch instead of the project's fetchWithBlacklist wrapper, so a crafted prompt that places an internal address (for example the cloud metadata endpoint at 169.254.169.254) into an attachment column causes the server to retrieve that URL and surface the fetched content via a presigned object-storage URL - potentially exposing cloud instance credentials. Exploitation requires a valid builder account and that the AI table generation feature be reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and the highest-impact outcome (credential theft) depends on the Budibase host running in a cloud environment with an exposed metadata service and configured object storage.
Server-side request forgery (SSRF) in LA-Studio Element Kit for Elementor through version 1.6.2 allows remote unauthenticated attackers to make the WordPress server issue arbitrary HTTP(S) requests to internal or external resources. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), no authentication or user interaction is required, and the scope change (S:C) with low confidentiality and integrity impact reflects that the attacker can pivot through the server to reach otherwise inaccessible services. No public exploit code or active exploitation is identified at time of analysis; risk is elevated for sites that expose cloud metadata endpoints or internal services to the WordPress host.
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated attacker make the gateway issue crafted requests to internal or otherwise unintended network destinations by simply delivering a message whose content references external resources - no credentials and no victim interaction are required. The vendor rates this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); our independent assessment concurs on the low exploitation barrier but bounds confidentiality impact to whatever internal endpoints are reachable from the gateway's server-side position and lowers integrity impact accordingly. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); a vendor patch is available in 9.5.0.
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote attacker cause the gateway itself to send crafted requests to internal or otherwise unintended network destinations by simply sending an inbound message that triggers an online certificate status check. Because the request originates from the gateway's own network position, an attacker can potentially reach internal services that are not directly exposed, leading to sensitive information disclosure and, depending on reachable targets, disruption of gateway availability. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); exploitation is nevertheless trivially reachable since it requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, score 9.1), with realized impact bounded by the gateway's internal network position and egress restrictions.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, 9.1) to make the gateway fetch attacker-chosen URLs by embedding a crafted certificate revocation list reference in an inbound message. Successful exploitation yields disclosure of information reachable from the gateway's network position or disruption of gateway availability, but no write access or code execution (I:N), so practical severity is bounded by what internal or cloud-metadata endpoints the appliance can actually reach - landing it in the medium operational-priority band despite the critical base score. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthenticated attacker who can deliver an inbound message cause the gateway to issue crafted HTTP requests to internal or otherwise unintended network destinations, with the trigger occurring during the gateway's issuer-certificate retrieval step. With CVSS 3.1 base score 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), a successful attack can disclose sensitive internal information reachable from the gateway's network position and/or disrupt gateway operation, but the practical impact is bounded by which internal services and metadata endpoints the gateway can reach and by whether any response data is reflected back to the attacker rather than being blind. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV), though the combination of network reachability, no authentication, and no user interaction makes this a genuine priority within the email security gateway niche.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender to embed URLs in message content that the gateway then fetches server-side and reflects back, exposing internal services and cloud instance metadata to the attacker. Because the gateway processes inbound mail from untrusted senders as its normal operating mode, no credentials or user interaction are required beyond delivering a crafted message to a protected recipient, and the confidentiality impact is high whenever the appliance runs on a cloud instance with an attached IAM role. No public exploit code has been identified at time of analysis; the issue is nevertheless high priority given the unauthenticated network vector, with our independent assessment scoring integrity impact as Low (reflecting that state changes depend on which internal endpoint is reachable) rather than the published vector's High.
Unauthenticated server-side request forgery (SSRF) in Kiteworks Secure Data Forms before 9.5.0 allows remote attackers to force the server to issue arbitrary outbound network requests and read back the responses, exposing internal-only services, cloud metadata endpoints, and other network-restricted resources. Exploitation requires no authentication (PR:N) and no user interaction (UI:N); our independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting the high confidentiality impact of reading internal responses rather than the vendor's C:N/I:H weighting. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated server-side request forgery in Tugtainer before version 1.30.6 allows any logged-in user with access to notification settings to make the backend send outbound HTTP requests to attacker-chosen URLs through the /settings/test_notification endpoint, reaching localhost, RFC1918 ranges, and cloud metadata addresses such as 169.254.169.254. The urls field is passed directly to the Apprise notification library with no scheme, hostname, private-IP, or metadata filtering in the default configuration, and because responses are not returned to the caller the attack is blind, which limits it to internal port scanning, service probing, and indirect information inference rather than straightforward data exfiltration. Our independent assessment agrees with the SSRF class and the authentication prerequisite (PR:L) but rates the CIA impact lower (C:L/I:L/A:L) than the vendor's 9.1 scoring, so the practical severity sits below the headline score; vendor-released patch: 1.30.6, and no public exploit identified at time of analysis, with no CISA KEV listing.
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an authenticated remote attacker who already holds high/administrative privileges pivot from the web interface to the underlying operating system, ultimately executing arbitrary commands as a privileged user. Devices running Instant On firmware version 3.4.1.0 and earlier are affected; the flaw is network-reachable with low attack complexity and full confidentiality, integrity, and availability impact (CVSS 3.1: 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but its practical reach is sharply limited by the PR:H prerequisite, meaning the attacker must first possess administrative credentials on the Instant ON management interface. No public exploit code or confirmed active exploitation was identified at time of analysis, and because exploitation is post-authentication, the realistic threat is an escalation-to-RCE step for an adversary who has already compromised or been granted AP administrator access.
Server-side request forgery (SSRF) in Joomla CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 allows an authenticated, high-privileged attacker to make the server issue requests to arbitrary URLs via improperly validated URLs in various core extensions. Exploitation requires a backend or administrator account and is not achievable by anonymous users; high attack complexity means a single reliable request is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in Stringer, a self-hosted RSS reader, allows an authenticated low-privileged user to make the server issue arbitrary HTTP/HTTPS requests to internal network hosts, loopback services, and cloud metadata endpoints such as AWS IMDS at 169.254.169.254. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, base 7.6) confirms a network-reachable, low-complexity attack requiring only an authenticated account - a barrier that collapses to near-anonymous when self-service signup (Setting::UserSignup) is enabled, since any visitor can register. Impact ranges from internal port and service scanning to theft of cloud IAM credentials when Stringer runs on a cloud instance with an attached role reachable via IMDSv1; there is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation, though the attack surface is trivial to exercise for anyone holding a valid session.
Axios versions 1.13.0 through 1.19.x on Node.js can silently bypass a configured HTTP(S) proxy or a caller-supplied DNS lookup policy for requests that opt into HTTP/2, because the HTTP/2 adapter calls http2.connect() without consistently applying config.proxy, environment-derived proxy settings, or config.lookup before the connection is established. This is a defense-in-depth control bypass (CWE-918, SSRF-adjacent): confidentiality and integrity impacts fall on the systems the bypassed egress or DNS control was meant to protect, not on the local vulnerable host, and exploitation is gated by non-default configuration - the application must explicitly set httpVersion: 2 and must actually depend on the proxy or lookup policy as a security boundary. Unauthenticated remote reachability is indicated by the CVSS vectors, but practical risk is moderate given the narrow affected version band and the opt-in requirement; no public exploit identified at time of analysis.
Server-side request forgery in fast-mcp-telegram prior to version 30.1 allows an authenticated MCP client (CVSS PR:L) to make the server fetch arbitrary internal HTTP(S) endpoints and receive the response body back as a Telegram file attachment. The send_message and send_message_to_phone tools accept URL lists that the server downloads via httpx.AsyncClient.get, but the _validate_url_security guard only inspects the literal hostname string and never resolves DNS, so any attacker-controlled domain that resolves to a loopback, private, or link-local address passes validation - even with the secure defaults block_private_ips=True and allow_http_urls=False. Because the fetched content is exfiltrated through the Telegram attachment rather than merely observed, this is a full-read SSRF; exploitation requires an authorized MCP session and a resolving hostname (raw private-IP literals remain blocked), and no public exploit code was identified at time of analysis.
Server-side request forgery in Apache Roller 6.1.5 allows an authenticated user holding entry-editing rights on a weblog to force the server to issue outbound HTTP requests to attacker-chosen destinations via the legacy outbound Trackback action and entry enclosure handling. No non-default configuration is required because the default Trackback allow-list is empty and therefore permits every destination, and although the Trackback control is hidden in the standard UI its Struts2 action remains directly reachable; requests can be aimed at loopback and private-network addresses, while the enclosure path additionally exposes response status, content type and length. CVE-2026-82375 carries a CVSS 3.1 score of 7.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, CWE-918) and no public exploit code was identified at time of analysis, with no confirmed active exploitation (CISA KEV); upgrading to Apache Roller 6.1.6 or later removes the outbound Trackback action and stops dereferencing enclosure URLs.
Server-side request forgery and local file inclusion in Regular Labs Modules Anywhere for Joomla (Pro versions 1.5.0 through 9.0.5) allow an attacker with content-authoring privileges to override module parameters and cause the server to open attacker-influenced URLs or local files. The parameter-override feature is enabled by default and applies attributes without verifying who authored the content containing the module tag; Joomla's core Feed module with its rssurl parameter is a confirmed vector. The vendor rates this 8.5 under CVSS 4.0, but the independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) indicates high technical impact with moderate real-world priority because authentication is required and exposure depends on the selected module; no public exploit was identified at time of analysis.
Server-side request forgery in Obot through v0.22.1 allows an authenticated user holding the Power User, Power User Plus, or Admin role to register a remote MCP server pointing at an arbitrary URL, which Obot then fetches server-side with no destination validation. Because the fetched response is reflected back in Obot's error messages, this is a non-blind SSRF: the attacker can read responses from internal services and, against the cloud metadata endpoint 169.254.169.254, potentially obtain the host's cloud IAM credentials and pivot into the cloud account. Exploitation is role-gated and requires authentication to be enabled with privileged users permitted to register remote MCP servers; there is no public exploit identified at time of analysis, and the issue is fixed in v0.23.0.
python-utcp versions before 1.1.4 allow server-side request forgery through the utcp-http plugin's HttpCommunicationProtocol.call_tool, which validates the initial tool URL but follows HTTP redirects with no per-hop re-validation, so an attacker-controlled tool endpoint can return a 3xx Location that drives the UTCP client into internal HTTP services or the cloud metadata endpoint (169.254.169.254) and returns the response body to the tool caller. The vulnerable path is the core UTCP pattern of registering a tool or manual/OpenAPI spec from a runtime-supplied URL and then invoking it; the initial URL only needs to pass ensure_secure_url (any https:// or a benign attacker-owned host), with the attacker supplying the redirect. Exploitation is remote and requires no privileges (CVSS 4.0 PR:N, assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), but it is gated on the host ingesting and invoking an attacker-influenced tool spec and on an internal HTTP service being reachable from the client, which keeps practical priority moderate rather than critical; no public exploit code was identified at time of analysis and the issue is not in CISA KEV. Vendor-released patch: 1.1.4.
Credential exfiltration and server-side request forgery in utcp-http 1.1.3 and earlier allow an attacker who supplies a malicious OpenAPI specification to redirect a victim's OAuth2 client_id and client_secret to an arbitrary token endpoint. The library validates discovery and tool-invocation URLs via ensure_secure_url() but never applies the same guard to the OAuth2 tokenUrl taken from a remote spec, so the attacker-chosen endpoint receives the credentials in cleartext when a generated OAuth2-protected tool is invoked. Exploitation requires victim interaction (the victim must register the attacker-controlled spec and call the generated tool) and no attacker authentication; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N (7.1), with the unvalidated endpoint also usable for SSRF against internal HTTP ranges. No public exploit identified at time of analysis.
Server-side request forgery in python-utcp (utcp-http) before 1.1.12 allows an unauthenticated remote attacker to cause a victim's client to issue requests to loopback services and return response bodies if the victim registers a malicious UTCP manual served from a non-loopback origin. Exploitation requires user interaction (registering the manual) and is limited to loopback interfaces, with further prerequisites of a loopback service that answers unauthenticated requests with useful data. No public exploit code exists, and the issue is fixed in utcp-http 1.1.12; this is a conditional-severity issue rather than a mass-exploitation threat.
Credential exfiltration in Heym before version 0.0.106 allows an authenticated collaborator who has been granted shared access to a credential to cause the server to transmit the credential owner's decrypted secret to an attacker-controlled endpoint. The flaw lives in the POST /api/credentials/test endpoint, where the destination URL supplied in the config parameter is not validated, so a low-privileged collaborator can redirect a credential-verification request (CWE-918 server-side request forgery) and harvest plaintext secrets they were never entitled to read. The vendor CVSS 4.0 assessment (7.1, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) confirms high confidentiality impact with no integrity or availability effect, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; risk is concentrated in multi-user, self-hosted deployments that rely on collaborator sharing, while single-user instances are not meaningfully exposed.
Non-blind server-side request forgery in heym (heymrun) before 0.0.109 lets any registered user redirect backend HTTP requests to loopback, private, link-local, or cloud-metadata addresses and read the full response body in the workflow node output. The flaw is confined to the Slack, Discord, and Crawler workflow nodes, which build requests from user-supplied credential URLs (webhook_url / flaresolverr_url) with an unguarded HTTP client that bypasses the SSRF egress guard already enforced on the HTTP, WebSocket, and MCP nodes. No public exploit code or confirmed active exploitation was identified at time of analysis, but exploitation requires only a valid account (PR:L) on an affected instance and no user interaction; the fixed release is 0.0.109.
Server-side request forgery in AzuraCast before 0.23.8 allows an authenticated user with the station-scoped WebHooks permission to make the server send outbound HTTP POST requests to internal, loopback, or RFC1918 addresses through the Generic and Discord webhook connectors. The AbstractConnector::getValidUrl() validation only rejects literal link-local IPs and skips validation entirely when the hostname is not a literal IP, and the same user can trigger the request on demand via the webhook test endpoint. No public exploit identified at time of analysis; risk is moderate because exploitation requires a low-privileged account and impact is largely a blind Now Playing POST unless the target internal service is reachable and responsive.
Server-side request forgery in AzuraCast (Composer package azuracast/azuracast, versions before 0.23.8 per the advisory) lets an authenticated user who holds the station-scoped RemoteRelays permission set a station's Remote Relay URL to loopback, private-network, or cloud-metadata addresses such as http://127.0.0.1:<port>/ or http://169.254.169.254/latest/meta-data/. Because the URL is validated only for syntax and an http/https scheme, the platform's periodic background Now Playing sync (AbstractRemote::getNowPlayingAsync) then automatically and repeatedly fetches that attacker-chosen address on the server's behalf, yielding blind SSRF against internal services and - on cloud-hosted instances with a reachable metadata endpoint - potentially exposing instance credentials or configuration. This is not an unauthenticated internet-facing flaw: exploitation requires an authenticated account with the RemoteRelays permission (PR:L in both the vendor's CVSS 4.0 vector and our CVSS 3.1 assessment), there is no public exploit code identified at time of analysis, and no patched release was confirmed at the time of the advisory.
Server-side request forgery in Kyverno before 1.19.1 lets a user who can author a ClusterPolicy or GlobalContextEntry with a non-CEL context[].apiCall.service call force the admission controller to issue GET/POST requests to an arbitrary destination, including cloud metadata endpoints, loopback, and any in-cluster service, thereby reading cloud instance credentials and reaching internal endpoints from Kyverno's network position. The vulnerable legacy executor and the GlobalContextEntry external-API path use a plain net/http client with no egress blocklist and no validation of the configured service URL, and they unconditionally attach Kyverno's projected ServiceAccount token to the attacker-chosen destination (the token is audience-scoped, limiting replay value). Exploitation requires high privileges because the attacker must already be able to write cluster-scoped policy objects (PR:H); the bar drops to a lower-privileged resource submitter only in the non-default case where a deployed policy templates the service URL from the admission resource. There is no public exploit identified at time of analysis, and the vendor rates the issue 8.3 (High) under CVSS 4.0.
Server-side request forgery in OpenClaw (npm package 'openclaw') before 2026.8.1 lets an attacker who can influence DNS for an already-allowlisted hostname bypass the trusted-host destination validation and reach a service bound only to loopback, disclosing that service's response. Exploitation is highly conditional and high-complexity: the fetch must go through the trusted-host DNS recheck path, the hostname must already be on the trusted-host allowlist, the attacker must be able to make it resolve to an unspecified address (0.0.0.0 or ::), and a loopback-bound service must actually exist and return useful data - impact is confidentiality-only. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor shipped a fix in 2026.8.1.
Authenticated blind server-side request forgery in Tandoor Recipes before 2.6.10 allows a user with privileges to create a Space and configure an AI provider URL to force the server to connect to arbitrary internal addresses. The AI actions behind TARGET/api/ai-import/ and api/ai-step-sort/ pass the attacker-supplied provider URL straight to LiteLLM, bypassing the application's safe_request outbound filtering, and the resulting connection success, refusal, or timeout is surfaced as a reachability oracle that can be used to map internal hosts, ports, and cloud metadata endpoints. Exploitation requires an authenticated account (PR:L) and the AI provider feature to be in use, and exposure is limited to a blind oracle rather than confirmed response-body exfiltration; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Server-side request forgery in Chaskiq through 2.0.3 allows unauthenticated attackers to make the server fetch arbitrary URLs-including internal network resources and cloud instance metadata endpoints-by submitting crafted requests to the createUrlUpload GraphQL mutation. The fetched content is stored as an ActiveStorage blob and returned to the attacker, enabling exfiltration of sensitive data such as IAM credentials from IMDSv1 endpoints. With a CVSS 9.2 severity and no authentication required, this is a high-priority issue; at time of analysis, no public exploit code was identified, though a technical writeup is publicly available. Note: confirmed actively exploited (CISA KEV) is not applicable; no public exploit identified at time of analysis.
Server-side request forgery in Wegow's ticket sales chart PDF export allows an authenticated promoter to inject malicious SVG content into the export request, causing the third-party Highcharts cloud service to fetch attacker-controlled external resources and embed the responses in the generated PDF. This provides a request proxying/laundering capability constrained to what the external SaaS can reach, and no public exploit has been identified at time of analysis. The CVSS 4.0 base score is 7.1 (High), driven almost entirely by high integrity impact (VI:H) while confidentiality and availability impacts are none, an unusual weighting for an SSRF which more typically carries a confidentiality impact.
Server-side request forgery in JobOps through 0.13.1 lets a caller submit an arbitrary url value to the POST /api/manual-jobs/fetch handler and have the server fetch internal destinations, with the response body returned to the caller, exposing loopback services, private-range hosts, and cloud instance metadata such as the 169.254.169.254 endpoint. In a standard deployment the request must carry valid authentication (PR:L per the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), but when the instance is running in demo mode unauthenticated clients can trigger the identical request, which is the configuration that removes the authentication barrier. Impact is confidentiality-only at 7.1 (no integrity or availability effect, no user interaction), and exploitation succeeds only if the target internal destination is network-reachable from the JobOps server; no public exploit code was identified at time of analysis, although a public technical writeup describing the flaw exists, and no KEV listing appears in the provided intelligence.
Server-side request forgery in PhastPress affects WordPress sites running the optional PhastPress performance plugin through version 3.10, allowing unauthenticated remote attackers to make the server fetch arbitrary URLs by spoofing the HTTP Host header. Because the plugin builds its scripts-service URL whitelist from that attacker-controlled header, no login, user interaction, or non-default configuration is required; impact is limited to the response data and any reachable internal or external services the WordPress host can access. No public exploit identified at time of analysis, and EPSS is not supplied in the source data, so this is a genuine but not top-priority SSRF risk pending patch adoption.
Unauthenticated XML External Entity (XXE) injection in Ellucian WebAdvisor 3.2 lets remote attackers POST crafted XML to the /WebAdvisor/WebAdvisor endpoint and abuse an XML parser that has external entity and DTD resolution left enabled, yielding server-side request forgery, coerced NTLMv2 hash disclosure to an attacker-controlled SMB share, and arbitrary file read from the underlying Windows host through an out-of-band error-based channel. No authentication or user interaction is required (CVSS vector shows AV:N/PR:N/UI:N), and impact is confined to confidentiality with no integrity or availability effect; the vendor-published CVSS 4.0 score is 8.7 while our independent assessment rates the same vector as high confidentiality impact only. No public exploit code has been identified at time of analysis, and real-world exposure is limited to legacy higher-education deployments because WebAdvisor reached end-of-support in June 2022.
Server-side request forgery in Renovate before 44.79.0 allows authenticated users with low privileges to direct the shared HTTP client at arbitrary internal URLs through 'extends' preset references or 'customDatasources' entries. An attacker who can influence Renovate's configuration - for example by committing to a scanned repository or controlling a preset source - can reach an instance metadata endpoint such as AWS IMDS to obtain credentials, or exfiltrate sensitive information into Renovate logs; real-world impact depends on the deployment's network reachability of internal services. The vendor fixed the issue in Renovate 44.79.0, and no public exploit code has been identified at time of analysis.
Memory exhaustion and limited configuration-resource disclosure affect OmniFaces (maven/org.omnifaces:omnifaces) before 1.14.3, 2.7.33, 3.14.23, 4.7.12 and 5.4.2 because CombinedResourceHandler accepts a structurally valid deflated, base64-encoded combined-resource ID without verifying the server issued it. A remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, base 8.2) who reaches a JSF application that has opted into the resource-combining handler can inflate a forged ID with roughly 770:1 amplification (about 20 KB input expanding to ~16 million characters, ~49 MB heap delta), add unique reconstructed IDs to a process-lifetime cache with no eviction, and read Facelets source from the webapp resource tree or META-INF/resources because jakarta.faces.RESOURCE_EXCLUDES is not applied on this custom resolution path. The advisory documents in-lab reproductions of these behaviors (including a blind, deployment-dependent server-side fetch when the non-default wildcard CDN mapping and an omnifaces.graphic inner resource are in play), but this is not confirmed as actively exploited and is not listed in CISA KEV; no public exploit code was identified at time of analysis.
TurboDocx html-to-docx through 1.23.1 is vulnerable to server-side request forgery (CWE-918): when an application converts attacker-supplied HTML to DOCX with remote image handling enabled, the library dereferences <img src> URLs server-side, and a loose isValidUrl() check allows loopback, RFC1918 private, and cloud metadata addresses (e.g. 169.254.169.254) to be requested and their responses embedded into the generated document's word/media folder. The flaw is remotely reachable without authentication or user interaction (CVSS:4.0 PR:N/UI:N, 8.2; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), and publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing) and no vendor-released patch identified at time of analysis. Real-world risk is conditional rather than universal: the attacker must supply a live, responsive internal target, the fetched response must be readable from the returned DOCX, and deployments that disable remote image fetching, filter outbound traffic, or restrict HTML input are not exploitable.
Directive injection in NGINX Gateway Fabric lets an authenticated namespaced tenant escape the auth_basic "<realm>"; quoting rendered into a shared data-plane nginx.conf and inject arbitrary NGINX directives. Exploitation requires a multi-tenant deployment in which several namespaces share one Gateway/data plane, plus namespaced RBAC to create an AuthenticationFilter CRD and attach it via spec.basic.realm or spec.jwt.realm to an HTTPRoute or GRPCRoute bound to that Gateway (CVSS vector shows PR:L and UI:N, so valid authenticated credentials are required and no user interaction is needed). The impact is control-plane only, with no data-plane exposure, but a successful attacker could read co-located tenants' mounted secrets, perform SSRF through proxy_pass, read the pod ServiceAccount token, or hijack other tenants' routes; no public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Unauthenticated server-side request forgery in Kan 0.5.5 through 0.6.0 allows remote attackers to make the server issue arbitrary outbound HTTP requests through the /api/download/attatchment route by supplying a crafted url query parameter. The flaw is an incomplete fix for CVE-2026-32255 and only manifests when the S3_ENDPOINT environment variable is unset or blank - the configuration the project's own .env.example documents as the intended setup for AWS S3 - in which case hostname validation is skipped entirely and the attacker-controlled URL is handed directly to fetch(). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but EPSS/scoring data and the unauthenticated network vector (CVSS 4.0 base 9.2, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) make this a high-priority fix for exposed deployments.
Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote attackers to induce the server to make arbitrary outbound requests, potentially reaching internal services and escalating privileges. The CVSS 3.1 base score is 8.6 (HIGH) with a changed scope, high confidentiality impact, and no integrity or availability impact. Exploitation requires no user interaction; no public exploit code has been identified at time of analysis, and the vendor advisory APSB26-163 should be consulted for fixes.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows an authenticated low-privileged attacker to coerce the application server into issuing requests to internal resources, yielding elevated access and disclosure of data outside the attacker's intended scope. Adobe assigns this a CVSS 3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N); exploitation is non-deterministic because the vendor states success depends on conditions beyond the attacker's control, and it requires an existing foothold as a low-privileged account. There is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk profile is that of a moderate-severity, post-authentication SSRF rather than a remotely exploitable unauthenticated flaw.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a high-privileged ColdFusion account force the server to issue requests to internal or otherwise restricted resources, resulting in privilege escalation and unauthorized access to internal services. The vulnerability is network-reachable (AV:N), needs no user interaction (UI:N), but is gated by the high-privilege precondition (PR:H), so it is not exploitable against default unauthenticated configurations - the practical risk is concentrated on internet-exposed ColdFusion administrative interfaces and insider or post-compromise scenarios. The CVSS vector changes scope (S:C), meaning the attacker can leverage the vulnerable ColdFusion component to affect resources outside its own security authority, and no public exploit code has been identified at time of analysis. This is a solid-priority-but-not-emergency issue rather than an emergency, driven mainly by the privileged access required to trigger it.
Server-side request forgery in Adobe ColdFusion 2023 (≤2023.0.25) and ColdFusion 2025 (≤2025.0.13) lets unauthenticated, network-reachable attackers coerce the server into issuing arbitrary outbound requests, with the changed scope (S:C) allowing those requests to pivot into back-end or cloud services that can confer elevated privileges. Rated CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, CWE-918), the flaw requires no authentication and no user interaction per the vector, but real-world data exposure depends on the ColdFusion instance having reachable internal targets such as cloud metadata endpoints or internal APIs. No CISA KEV listing and no public exploit code were identified at time of analysis, yet the default-configuration exposure of affected versions makes prompt patching advisable.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) allows a low-privileged authenticated attacker to make the ColdFusion server issue requests to internal or otherwise restricted resources, potentially escalating access and reading sensitive data. The vulnerability is rated CVSS 3.1 7.7 with scope changed and high confidentiality impact only; authentication as a low-privileged user is required (PR:L), no user interaction is needed, and no public exploit code was identified at time of analysis.
Server-side request forgery in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows unauthenticated remote attackers to cause the server to make arbitrary requests, resulting in privilege escalation with the scope changed. This critical vulnerability has a CVSS score of 10.0 and requires no user interaction. No public exploit has been identified at the time of analysis.
Server-side request forgery in Adobe ColdFusion lets remote unauthenticated attackers force the server to issue requests to internal or otherwise protected endpoints, which Adobe flags as potentially escalating privileges across a security boundary. The affected builds are ColdFusion 2023 up to and including 2023.0.25 and ColdFusion 2025 up to and including 2025.0.13; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) confirms no user interaction and no authentication prerequisite, with confidentiality being the only impact dimension assessed. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, so risk derives from high internet/network exposure of affected builds rather than confirmed active exploitation. Real-world severity hinges on what the ColdFusion host can reach internally, since a scope-changed SSRF that touches cloud metadata services or internal admin APIs can yield credential material even without an integrity or availability impact.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privileged user on the target farm coerce the server into issuing requests to attacker-influenced destinations, which Microsoft rates as a network-vector privilege elevation (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not trivial: the assessed conditions require a valid low-privileged account (PR:L) plus environmental factors captured by AC:H - a reachable internal target, specific server configuration, and/or timing and state dependencies that the attacker does not fully control. Only SharePoint Server Subscription Edition builds 16.0.0 below 16.0.20326.20190 are affected, no user interaction is needed (UI:N), no public exploit was identified at time of analysis, and CISA's SSVC evaluation records Exploitation: none and Automatable: no, so this is a real but non-urgent patching priority rather than an emergency.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition (on-premises builds 16.0.0 below 16.0.20326.20190) lets an authenticated, low-privilege user coerce the SharePoint server into issuing HTTP requests to internal or otherwise unreachable endpoints, producing high confidentiality, integrity and availability impact and enabling privilege elevation over the network. The issue is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), so an existing authenticated account is required and additional server-side conditions must be satisfied for the forgery to succeed, which materially limits reliability. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none', and Microsoft has published a vendor-released fix, making this a genuine but moderate-priority issue rather than a drop-everything emergency.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker with low privileges force the SharePoint application server to issue crafted requests on their behalf, which can expose sensitive internal resources and, per Microsoft's rating, enable privilege elevation over a network. The affected builds are SharePoint Server Subscription Edition versions earlier than 16.0.20326.20190, and exploitation requires network access plus a valid low-privileged account while also requiring attack-specific conditions that Microsoft captures as high complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5). CISA's SSVC decision data records Exploitation: none, Automatable: no, and Technical Impact: total, so no public exploit code or in-the-wild activity is identified; the impact is nonetheless potentially total against confidentiality, integrity, and availability once the request-forgery primitive is chained successfully, and a vendor patch is available. This is a moderate-priority vulnerability that does not currently rise to emergency status.
Finsys Dockhand before 1.0.43 turns authenticated stack-template submission into a server-side data-theft primitive: an attacker-supplied repository URL or stackfile value is fetched by the server and the fetched body is echoed back in the compose response field, so internal services and cloud instance-metadata endpoints can be read directly rather than probed blindly. Any holder of a valid Dockhand account with the ability to create or submit stack templates to the API compose endpoint can exploit this, and the impact grows sharply where the instance has reachable IMDS or sensitive internal services on its network. No public exploit code was identified at time of analysis, and the vendor has released version 1.0.43 as the fix; the 8.4 score reflects high confidentiality impact tempered by the requirement for an authenticated account.
Kubeflow Model Registry through 0.3.17 allows an authenticated namespace user with permission to create InferenceService resources to steal the InferenceService controller's ServiceAccount bearer token. The attacker creates an InferenceService with the modelregistry.kubeflow.org/url annotation pointing to an attacker-controlled server; the controller follows the annotation and attaches its token, which the attacker captures and then uses to modify other tenants' InferenceServices cluster-wide. This is a server-side request forgery (CWE-918) requiring low privileges (PR:L) and no user interaction; no public exploit code was identified at time of analysis, and no CISA KEV entry exists.
Unauthenticated resource exhaustion and outbound request amplification in Misskey's fetch-rss API affect versions 12.112.1 through releases prior to 2026.7.0. Any remote attacker can repeatedly call the publicly reachable endpoint, which in affected versions had no rate limiting, no response-size cap, and no concurrency bound, forcing the instance to open unbounded outbound HTTP connections and perform synchronous XML parsing; this drains instance CPU, memory, and socket resources, can be used as an amplification vector against third-party servers, and can probe network-reachable services even when federation is disabled. CVSS 4.0 scores the flaw 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N, high availability impact with limited scope change), no public exploit code or CISA KEV entry was identified at time of analysis, and the issue is fully remediated by upgrading to 2026.7.0.
Unauthenticated remote attackers can abuse NVIDIA AIStore's experimental HT backend to perform server-side request forgery by supplying a crafted 'original URL' value, causing the AIStore server to issue requests to attacker-chosen destinations and disclose information reachable from the server's network position. The flaw carries a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting no authentication or user interaction requirement and a scope change, with impact confined to confidentiality - integrity and availability are unaffected. There is no public exploit identified at time of analysis, and the practical risk is gated almost entirely on whether the experimental HT backend has been enabled on a network-exposed deployment, since that component is not part of the default AIStore configuration and is only reachable in non-standard setups.
Server-side request forgery in NVIDIA AIStore for Linux's distributed sort (dsort) component allows remote unauthenticated attackers to make an AIStore node issue outbound HTTP requests to an arbitrary URL by supplying a crafted external key map URL, resulting in disclosure of information from internal or otherwise unreachable services. The CVSS 3.1 base score is 8.6 (High) via AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, meaning the attack is network reachable, low complexity, requires no privileges and no user interaction, with the impact limited to confidentiality (integrity and availability are unaffected). At time of analysis no public exploit code has been identified, there is no CISA KEV listing for this CVE, and no EPSS score was supplied in the available data.
Server-side request forgery in the SAP Cloud SDK for Python lets remote, unauthenticated attackers redirect OAuth2 token requests to a server they control by manipulating the tenant_subdomain value used to build the token endpoint URL, resulting in exfiltration of the application's OAuth2 client credentials. Exposure is limited to multi-tenant SAP BTP applications that use the SDK for OAuth2 token acquisition and allow attacker influence over the tenant_subdomain input; single-tenant deployments, or those that do not derive the token URL from attacker-supplied data, are not exposed. The vulnerability carries a maximum-severity score of CVSS 10.0, and no public exploit code was identified at time of analysis; no confirmed actively exploited (CISA KEV) status applies.
Authenticated users of the Red Hat OpenShift web console can abuse the Helm chart URL input to make the console pod issue requests to arbitrary destinations, turning the console into a Server-Side Request Forgery (SSRF) proxy (CWE-918, CVSS 3.1 base 7.7). Because the console pod typically sits inside the cluster network with broader reachability than the user, a low-privileged console account with the ability to add or load a Helm chart can use leaked error output to read sensitive responses and can perform blind port scanning against internal services. Exploitation requires an authenticated console session and the privilege to supply a chart repository URL (PR:L, unauthenticated outsiders cannot reach it), and the assessed impact is confidentiality-only with no integrity or availability effect; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Unauthenticated remote attackers can exploit deprecated OpsDirector functionality in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 to perform server-side request forgery (SSRF), making unauthorized requests to internal services or forging trusted requests that may expose protected information. Exploitation is conditional on the OpsDirector component being present and network-reachable; no public exploit code has been identified at time of analysis. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability impact.
Server-side request forgery in Linux-based Progress MarkLogic Server 11.x and 12.x allows an authenticated, low-privileged user to coerce the database server into making HTTP requests toward internal endpoints reachable from its network position, which in cloud-hosted deployments can expose instance metadata services and the cloud credentials they hold. Exploitation requires valid low-privilege credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) plus a deployment where an internal metadata or credential service is actually reachable, so on-premises or otherwise isolated installations gain no credential-theft payoff and no unauthenticated path exists. Only releases before 12.1.0 (12.x) and before 11.3.7 (11.x) are affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7) when hosted on Microsoft Azure lets an authenticated attacker induce the server to issue requests against internal cloud services, potentially exposing Azure credentials or tokens. The flaw carries a CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), reflecting a scope change into the cloud control plane and high confidentiality impact; exploitation requires a valid low-privileged MarkLogic account and an Azure deployment, so on-premises and non-Azure instances are outside the described scope. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the highest-value outcome for an attacker is credential or token theft rather than code execution or denial of service.
Server-side request forgery in Crawl4AI (unclecode) versions 0.7.0 through 0.9.3 lets unauthenticated, remote API clients force the crawler to fetch internal, private, and cloud-metadata URLs and hand back the parsed head data of those responses. The attack abuses the optional link_preview_config on /crawl requests: an attacker submits a page they control with include_external and include_patterns enabled, and the AsyncUrlSeeder component then follows links pointing at internal services or the cloud instance metadata endpoint. Exploitation requires the non-default link_preview_config feature to be active and the /crawl API to be network-reachable; the CVSS vector (PR:N, UI:N) indicates no authentication or user interaction is needed once those conditions hold. No public exploit code has been identified at time of analysis, and the issue is rated 9.2 under CVSS 4.0 (independent assessment: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), making this a genuinely high-priority flaw for affected deployments.
Server-side request forgery in the Builderius WordPress plugin (versions 1.4 through 1.4-beta) lets an attacker drive the affected site to make arbitrary outbound HTTP requests, potentially reaching internal services, localhost, and cloud instance metadata endpoints. Our independent assessment scores this as network-reachable, low-complexity, and requiring low-privileged authenticated access (PR:L, base 7.2 HIGH), while the vendor-supplied vector claims unauthenticated access (PR:N) that remains unverified; comparable WordPress plugin SSRFs in practice often require a logged-in user. Impact is limited to low confidentiality and integrity with a scope change, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated server-side request forgery in the StreamCast WordPress plugin (versions 2.4.5 and earlier, published by Bplugins) lets a remote attacker coerce the affected WordPress site into issuing attacker-chosen outbound HTTP requests to internal, loopback, or otherwise non-public hosts. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) indicates exploitation requires only network reachability of the plugin endpoint on a default installation - no credentials, no user interaction - with the scope change reflecting impact on systems beyond the WordPress instance itself, though the low confidentiality and integrity ratings mean the practical payoff is internal reconnaissance and limited data disclosure rather than full site compromise. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV); real-world attack value depends heavily on what internal services, control-plane APIs, or cloud metadata endpoints the target web server can actually reach.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already holds high-privilege (administrative) credentials to coerce the appliance into issuing requests to attacker-chosen destinations, causing information disclosure, unauthorized access, and bypass of protection mechanisms (CWE-918; CVE-2026-78024). The scope-change metric (S:C) indicates forged requests can affect systems beyond the vulnerable component, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N confirms the exploitation prerequisite is authenticated administrator access - this is the primary limiting factor and means unauthenticated or low-privileged remote users cannot trigger it. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA KEV: no; SSVC exploitation: none), EPSS is only 0.20% (9th percentile), and a vendor patch is available, so this ranks as a moderate, non-urgent priority despite its 8.7 'High' base score.
Privilege escalation in Microsoft Azure SRE Agent lets an authenticated, low-privileged user exploit a missing authorization check in a server-side request-forwarding (SSRF) path to reach resources and act with the agent's higher-privileged identity, yielding high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Because the flaw sits in a Microsoft-managed cloud service, no customer-side configuration is required to trigger it - the only real gate is that the attacker must already hold a valid, authorized low-privileged identity in the service (PR:L, matching the advisory's 'authorized attacker' wording). Risk signals are moderate rather than urgent: EPSS is 0.39% (31st percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis; a vendor patch is available per Microsoft's advisory.
Unauthenticated server-side request forgery and missing authorization in Dromara Skyeye let remote attackers drive the server to fetch attacker-chosen internal URLs and overwrite any user's stored file through the OnlyOffice save callback editUploadOfficeFileById, then retrieve the modified content via queryFileToShowById. The flaw carries a CVSS 4.0 base score of 9.1 (PR:N, UI:N), although the assessed high attack complexity (AC:H/AT:P) reflects that a valid file id/key and an active OnlyOffice document-editing/callback flow are likely prerequisites, and SSRF reach is bounded by what internal addresses the server can resolve. No public exploit code was identified and the issue is not listed in CISA KEV at time of analysis.
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to force the server to download arbitrary URLs via the unmodified upstream FilePond PHP fetch API route, then read back the fetched content through the transfer directory. The flaw, identified as CWE-918, affects Malcolm deployments using the file-upload feature and can expose internal network services or cloud metadata due to curl's FOLLOWLOCATION behavior. No public exploit identified at time of analysis; exploitation requires access to the upload endpoint (PR:L), and impact is limited to confidentiality readback plus minor availability (storage consumption).
Unauthenticated server-side request forgery (SSRF) in the Cisco Finesse web-based management interface lets remote attackers send crafted HTTP requests that cause the device to make requests to associated services, potentially exposing limited sensitive information. The flaw is caused by improper input validation for specific HTTP requests and requires network reachability to the management interface but no credentials or user interaction; CVSS 3.1 score is 7.2, driven largely by scope change rather than severe direct impact. No public exploit identified at time of analysis.
Pre-authentication server-side request forgery in the SonicWall SMA1000 Appliance's Work Place interface lets a remote attacker who can reach the appliance abuse an unintended alternate access path that bypasses authentication and coerce the device into issuing requests on the attacker's behalf, reaching internal functionality that is not otherwise exposed externally (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - high confidentiality impact, low integrity impact, no availability impact). Affected builds are SMA1000 12.4.3-03526 (platform-hotfix) and older, and 12.5.0-02952 (platform-hotfix) and older; because the Work Place portal is normally internet-facing on these remote-access appliances, exposure is broad and this is a genuine top-priority vulnerability rather than a high-CVSS-but-low-risk artifact. No public exploit identified at time of analysis, and exploitation requires only default network reachability with no credentials and no user interaction, so the practical impact is bounded mainly by which internal services the appliance can reach through the forged requests.
Server-side request forgery in Gitea 1.27.3 and earlier lets a user who can start a repository migration or mirror reach blocked internal addresses: Gitea validates the destination hostname against its egress allow/block lists before invoking Git, but the Git subprocess resolves the hostname independently when it actually connects, so an attacker who controls the destination's DNS can re-point the name from an allowed address to an internal one between validation and connection. Exploitation requires both the ability to initiate a migration (on a default install this means a logged-in account, and instances with open registration make it effectively unauthenticated) and control of authoritative DNS with suitably short TTLs, which is why the independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N rather than the vendor's 7.5. No public exploit code has been identified at time of analysis, EPSS is only 0.15% (3rd percentile), and SSVC records Exploitation: none with partial technical impact; the vendor-released fix is Gitea 28.0.0.
Server-side request forgery in Gitea (versions up to and including 1.27.3) lets a repository administrator bypass the configured outbound host policy: Gitea validates the initial remote URL for push mirrors, wiki remote checks, and migrated pull-request heads, but the raw Git operation that follows will chase an HTTP redirect to an address the policy would otherwise block, causing the server's Git client to reach internal services. Exploitation is meaningfully constrained - it requires repository-administrator privileges, a restrictive egress allow-list must actually be configured, and the attacker must control or locate an allow-listed endpoint that redirects to the desired internal target - so the realized impact is bounded by which internal services are reachable from the Gitea host. EPSS is 0.15% (3rd percentile), no public exploit identified at time of analysis, and there is no CISA KEV listing, so exploitation appears opportunistic and low-volume rather than confirmed actively exploited. Note that the published CVSS vector (7.5, PR:N) overstates the privilege requirement; our assessment rates it PR:L with limited confidentiality and integrity impact.
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0 through 1.15.4) lets an authenticated user who controls a TechDocs source repository have documentation builds fetch and publish content from network locations reachable by the build environment. The issue is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting a confidentiality-only, scope-changing impact that requires repo write access and a build topology where internal endpoints are reachable without token or special-header protections; newer cloud metadata services that require tokens or custom headers are explicitly not directly accessible. Vendor-released patches exist in @backstage/plugin-techdocs-node 1.14.7 and 1.15.5 (and in Backstage releases v1.50.6, v1.54.8, v1.55.0); no public exploit identified at time of analysis.
Server-side request forgery in GitHub Enterprise Server 3.20, 3.21, and 3.22 lets an authenticated repository contributor with push permission cause the appliance to issue requests to attacker-controlled internal hosts, which can be chained to remote code execution on the appliance. The flaw sits in the secret scanning validator for GCP service account credentials, which trusts the token endpoint embedded in a committed credential and sends a request to it without restricting the destination, and it additionally requires GitHub Advanced Security with secret scanning validity checks enabled, a non-default configuration. No public exploit identified at time of analysis; vendor-released patches are 3.20.9, 3.21.7, and 3.22.2, and the issue was reported through the GitHub Bug Bounty program.
Unauthenticated server-side request forgery in the Instapage WordPress plugin, affecting all versions up to and including 3.7.2, lets any remote attacker who can reach a vulnerable site make the web server issue requests to arbitrary internal or external destinations. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) confirms the attack is network-reachable, requires no credentials and no user interaction, and crosses a security scope boundary, though the Low confidentiality and Low integrity ratings indicate constrained response retrieval and limited write effects rather than full data exfiltration. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and no EPSS or KEV data was supplied; this is a medium-to-high severity, lower-urgency issue whose practical impact depends on what internal services, cloud metadata endpoints, or trusted-network resources are reachable from the affected web server.
Unauthenticated server-side request forgery in the WordPress plugin PDF Smart Viewer for Elementor (versions 1.0.4 and earlier) lets any remote attacker induce the affected site's server to fetch an arbitrary URL of the attacker's choosing, with no authentication (PR:N) and no user interaction (UI:N) required per the assessed CVSS vector. Because the scope is changed (S:C) but confidentiality and integrity impacts are bounded (C:L/I:L), a successful attack typically means using the WordPress host as a request proxy to probe or interact with internal-only services, loopback interfaces, or cloud instance metadata endpoints rather than direct compromise of the plugin itself. Only sites with the plugin installed and active, and whose PDF-fetching functionality is reachable, are exposed; no public exploit code was identified at time of analysis, and exploitation is not confirmed as active in the wild.
Server-side request forgery in Dify (LangGenius) before 1.13.0 allows unauthenticated remote attackers to make the Dify server fetch attacker-supplied URLs through the /console/api/remote-files/upload (POST) and /remote-files/<path:url> (GET) endpoints, turning the instance into a network pivot against internal services and cloud metadata endpoints. Rated CVSS 3.1 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L), the issue is unauthenticated by design - the fix adds @login_required - but practical exploitability is bounded by Dify's existing ssrf_proxy wrapper, which may filter internal or metadata targets depending on allowlist configuration. No public exploit code identified at time of analysis and no confirmed active exploitation; a vendor-released patch (1.13.0) is available.
Authenticated users who can create a workspace in Plane can force the application's background worker to fetch internal-only resources - including cloud instance metadata endpoints - by registering a webhook whose URL points at an attacker-controlled public host that returns a 302 redirect to a private, loopback, or link-local address. Because the pre-1.4.0 webhook delivery task calls requests.post() without disabling redirects and only validates the originally submitted URL, the fetched response body is written into webhook_logs and can be read back through the workspace webhook-logs API, turning the SSRF into a practical internal-data exfiltration channel. All Plane versions prior to 1.4.0 are affected; the issue is fixed in 1.4.0, no public exploit code has been identified at time of analysis, and exploitation requires authentication plus workspace-creation privileges rather than being anonymous.
Server-side request forgery in Plane (makeplane/plane) before 1.4.0 lets an authenticated user abuse the OAuth avatar synchronization flow to make the Plane server fetch internal-only resources and then retrieve the fetched bytes through the public /api/assets/v2/static/{asset_id}/ asset endpoint. The avatar_url value taken from the attacker's OAuth provider profile is fetched server-side without internal-IP validation and with redirects followed by default, so a public URL can be used to bounce the request to a cloud metadata service (169.254.169.254) or an internal admin API reachable from the Plane host. Vendor-released patch: 1.4.0 (advisory GHSA-cv9p-325g-wmv5); no public exploit identified at time of analysis. The exploitation conditions are real but conditional - OAuth-based authentication with avatar sync must be enabled and the server must be able to reach something sensitive internally - so cloud-hosted deployments are the most exposed, and this is a legitimate but conditional risk rather than a drop-everything emergency.
Server-side request forgery in the Plane project-management platform (makeplane/plane) prior to 1.4.0 allows any authenticated project member to make the server fetch attacker-chosen internal URLs during work-item link unfurling and read the response body back as the link title or favicon, producing a readable rather than blind SSRF. The vulnerable behaviour is a regression-style gap: the fix shipped in v1.2.2 for CVE-2026-27706 / GHSA-jcc6-f9v6-f7jw (also an SSRF in link unfurling) remains incomplete in the v1.3.1 GA release, so the v1.2.2 mitigation alone is not sufficient on that line. Rated CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), exploitation requires a low-privileged authenticated account, and no public exploit code has been identified at time of analysis; the highest-value outcome is theft of cloud IAM credentials by targeting the instance metadata endpoint at 169.254.169.254 on cloud-hosted deployments, where the link fetcher can reach internal metadata or internal-only services.
Server-side request forgery in Plane, the open-source project management tool, allows a low-privilege user of a connected Gitea instance to make the Plane server issue HTTP requests to internal or private addresses. The flaw affects versions prior to 1.4.0 and only manifests when an administrator has explicitly enabled Gitea OAuth and pointed GITEA_HOST at a legitimate Gitea deployment (the feature is off by default); an authenticated Gitea user then sets an internal URL as their profile avatar and logs in through OAuth, causing Plane to fetch that attacker-chosen target without validation. The result is a largely blind SSRF primitive, since the avatar handler only accepts image Content-Types and enforces a size cap, and no public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in self-hosted Plane (makeplane/plane) versions prior to 1.4.0 lets an authenticated workspace administrator who can create or edit webhooks point a webhook at an attacker-controlled hostname and then rebind that hostname to an internal IP address, causing the background delivery worker to issue requests against internal services, cloud metadata endpoints, or other hosts reachable from the API/worker containers. The flaw is a bypass of the earlier SSRF fix for CVE-2026-30242: creation-time IP validation is performed in apps/api/plane/app/serializers/webhook.py, but apps/api/plane/bgtasks/webhook_task.py independently re-resolves the hostname at send time without validating the result, leaving a DNS-rebinding TOCTOU gap. Per the assessed CVSS 3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N (base 7.6), exploitation demands high administrative privilege and a successfully won DNS race, but yields high confidentiality impact and scope change; no public exploit code has been identified at time of analysis and the issue is fixed in Plane 1.4.0.
Server-side request forgery in Eclipse Che 7.29.0 and later allows any authenticated low-privilege user to make the workspace server fetch attacker-chosen URLs through the GET /api/scm/resolve and POST /api/factory/resolver endpoints, which pass the URL to URLFetcher.fetch() without any scheme or host allow-list. Successful abuse yields high confidentiality loss: arbitrary local file reads inside the Che pod (notably the Kubernetes service-account token at file:///var/run/secrets/kubernetes.io/serviceaccount/token), access to internal HTTP services and cloud instance metadata at 169.254.169.254, and delivery of the victim's stored SCM personal access token as an Authorization header to a host of the attacker's choosing; integrity impact is more limited, largely the unauthorized use of forwarded credentials. No vendor-released patch was identified at time of analysis and no public exploit code was identified at time of analysis, though the affected code paths are reachable by any authenticated user. A second, interaction-dependent variant triggers the credential forwarding when a victim opens a workspace from a malicious devfile whose parent.uri points at an attacker-controlled server.
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Server-side request forgery in Feehi CMS 2.1.1 allows remote attackers to coerce the server into issuing HTTP requests to attacker-chosen URLs via the bundled UEditor 'catchimage' image-fetch endpoint, because the private-IP validation routine fails to block loopback (e.g. 127.0.0.1) and link-local (e.g. 169.254.169.254) destinations. The SSRF is semi-blind - the attacker infers internal service state through observable response differences rather than receiving full response bodies - so practical impact is limited to internal service probing and information disclosure, with no confirmed integrity or write effect; the supplied vector rates it 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), while the independent assessment downgrades confidentiality to Low (C:L) and notes that PR:N is unverified because catchimage may sit behind an authenticated CMS session. Publicly available exploit code exists (SSVC Exploitation: poc) and the issue is automatable, but there is no confirmed active exploitation (not in CISA KEV), and the EPSS score is low at 0.14% (3rd percentile), indicating limited near-term exploitation likelihood at scale.
Server-side request forgery in Loom for AWS before 1.7.0 lets an authenticated user with privileges to register, update, or test a tool server or remote agent (the MCP Server / A2A Agent integration feature) supply a crafted connection address that the backend fetcher follows and whose response body it echoes back, exposing the application container's own IAM role credentials and responses from arbitrary internal network locations. Exploitation requires a high-privileged authenticated account (CVSS PR:H) and is only meaningful where the container runs with a role worth stealing; there is no anonymous or pre-authentication path, and no public exploit identified at time of analysis. Deployments on or upgraded to 1.7.0, which adds IP-validated, DNS-pinned fetchers and connection-sink guards, are not affected.
Server-side request forgery in the OAuth2 discovery handling of Loom for AWS (awslabs/loom) before 1.7.0 lets an authenticated user who can register a tool server or remote agent supply a crafted discovery document address, causing the backend to make requests to arbitrary internal network locations and - in deployments using delegated authentication - to leak another user's access token. The prerequisites are meaningful: the attacker needs high privileges to register the tool server/remote agent (PR:H) and the token-disclosure outcome requires passive interaction from a victim user (UI:P), so this is a credible, above-average-priority issue rather than an emergency, and it only affects deployments actually using the OAuth2/OIDC delegated-authentication discovery feature. There is no public exploit identified at time of analysis; the vendor has released Loom 1.7.0, which adds a deployment-trusted issuer host requirement before any token exchange and applies an IP-validated, DNS-pinned fetcher to all outbound OAuth2/OIDC calls.
Improper restriction of XInclude resource resolution in Copernik XML Factory through 0.1.1 allows an attacker-controlled XML document to resolve xi:include hrefs when the stock JDK provider is in use, resulting in local file disclosure and server-side request forgery against internal HTTP endpoints. Only applications that obtain a factory from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory() (or harden an externally supplied XMLReader via XmlFactories.harden()), run without Apache Xerces (xercesImpl) on the classpath, explicitly enable XInclude with setXIncludeAware(true) or the equivalent reader feature, and parse XML from an untrusted source are affected; the Xerces provider and the Android provider are not affected. No CVSS vector, EPSS score, or CISA KEV entry was provided, so no public exploit or active exploitation was identified at time of analysis, although the defect is confirmed and fixed by upstream commits and the 0.1.2 release.
Server-side request forgery in the Next.js Image Optimization endpoint lets a remote, unauthenticated attacker cause the server to fetch images from private or internal IP addresses, but only in applications that have configured images.remotePatterns. Affected releases are Next.js 16.0.0 through 16.3.7; the flaw is fixed in 16.3.8 by pinning the outbound connection to the DNS addresses that were already validated against the allow-list. Exploitation is not deterministic - the attacker must win a timing race between the allow-list check and the socket's own DNS lookup (DNS rebinding), consistent with the high attack-complexity rating - and no public exploit code has been identified at time of analysis (EPSS/KEV signals were not provided).
Server-side request forgery in YesWiki before 4.6.7 allows unauthenticated remote attackers to force the server to issue arbitrary GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action, with fetched responses stored back as readable Bazar entries. The CVE carries a CVSS 4.0 base score of 8.8 (AV:N/AC:L/AT:N/PR:N/UI:N, high confidentiality impact, low integrity and availability impact), matching our independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L - no special privileges or user interaction are required, only network reachability to an instance running a vulnerable version that exposes the sync action. Impact is highest where the YesWiki host sits adjacent to internal services or a cloud metadata endpoint, and no public exploit code has been identified at time of analysis; the issue is not listed as confirmed actively exploited (CISA KEV).
Server-side request forgery in YesWiki versions before 4.6.7 allows unauthenticated remote attackers to make the server issue blind GET and POST requests to internal hosts or cloud metadata endpoints by sending signed Follow activities to the public forms actor ActivityPub inbox. The attacker signs each request with their own keyId and places an internal actor URL in the ActivityPub body, so no victim credentials are required, but the attack succeeds only when the ActivityPub handling path processes the signed activity and a useful internal target is reachable. A vendor patch is available in 4.6.7; no public exploit was identified at time of analysis, and the independent assessment rates this as a moderate priority because reliability is constrained and confidentiality impact depends on cloud or segmented network exposure.
Server-side request forgery in YesWiki before 4.6.7 lets unauthenticated attackers reach internal services and cloud metadata endpoints by sending a crafted ActivityPub Signature keyId whose URL is expressed as an IPv6 transition address (6to4, NAT64, or IPv4-compatible IPv6), evading validateKeyIdUrl()'s SSRF guard. Exploitation requires the public federation actor-inbox route to be reachable by the attacker and involves non-trivial payload crafting, consistent with the independent assessment of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N; no public exploit identified at time of analysis. Real-world impact depends heavily on what the YesWiki server can reach internally - cloud metadata (169.254.169.254), loopback services, or internal hosts make it serious, while instances without reachable internal targets yield little value.
Full-read server-side request forgery in GetSimple CMS CE versions prior to 1.5 allows an authenticated attacker with access to the update handler form to make the server fetch arbitrary URLs and read the response body back from a web-accessible file. The handler applies only FILTER_VALIDATE_URL format checking with no destination or scheme allowlisting, so requests can be aimed at internal-only services and cloud metadata endpoints such as 169.254.169.254, with the fetched body written to /Tmpfile.zip and left in place even when it is not a valid ZIP. Exploitation requires high privileges (CVSS PR:H) and the installed version must be below 1.5; publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and vendor-released patch 1.5 is available.
Server-side request forgery in Vvveb CMS builds prior to 1.0.8.6 allows an authenticated admin-panel user (default role site_admin or higher) to make the editor's oEmbed proxy fetch attacker-chosen URLs server-side and read the reflected response body, exposing internal-only HTTP services and cloud metadata endpoints including IAM credentials. The bypass works because Vvveb's SSRF guard resolves hosts with an IPv4-only function, so a bare IPv6 literal or a domain publishing only an AAAA record never matches the private-range check, while hosts with an A record remain blocked. Exploitation is access-gated by the PR:H requirement and by whether the deployment actually exposes reachable internal services or a metadata endpoint; no public exploit identified at time of analysis. The issue is patched in 1.0.8.6.
Server-side request forgery in Budibase through 3.41.0 allows an authenticated builder-level user to make the server fetch arbitrary internal URLs and read the response back through the AI table generation endpoint (POST /api/ai/tables). The uploadUrl helper in packages/server/src/utilities/fileUtils.ts calls raw node-fetch instead of the project's fetchWithBlacklist wrapper, so a crafted prompt that places an internal address (for example the cloud metadata endpoint at 169.254.169.254) into an attachment column causes the server to retrieve that URL and surface the fetched content via a presigned object-storage URL - potentially exposing cloud instance credentials. Exploitation requires a valid builder account and that the AI table generation feature be reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and the highest-impact outcome (credential theft) depends on the Budibase host running in a cloud environment with an exposed metadata service and configured object storage.
Server-side request forgery (SSRF) in LA-Studio Element Kit for Elementor through version 1.6.2 allows remote unauthenticated attackers to make the WordPress server issue arbitrary HTTP(S) requests to internal or external resources. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), no authentication or user interaction is required, and the scope change (S:C) with low confidentiality and integrity impact reflects that the attacker can pivot through the server to reach otherwise inaccessible services. No public exploit code or active exploitation is identified at time of analysis; risk is elevated for sites that expose cloud metadata endpoints or internal services to the WordPress host.
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated attacker make the gateway issue crafted requests to internal or otherwise unintended network destinations by simply delivering a message whose content references external resources - no credentials and no victim interaction are required. The vendor rates this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N); our independent assessment concurs on the low exploitation barrier but bounds confidentiality impact to whatever internal endpoints are reachable from the gateway's server-side position and lowers integrity impact accordingly. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); a vendor patch is available in 9.5.0.
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote attacker cause the gateway itself to send crafted requests to internal or otherwise unintended network destinations by simply sending an inbound message that triggers an online certificate status check. Because the request originates from the gateway's own network position, an attacker can potentially reach internal services that are not directly exposed, leading to sensitive information disclosure and, depending on reachable targets, disruption of gateway availability. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); exploitation is nevertheless trivially reachable since it requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, score 9.1), with realized impact bounded by the gateway's internal network position and egress restrictions.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, 9.1) to make the gateway fetch attacker-chosen URLs by embedding a crafted certificate revocation list reference in an inbound message. Successful exploitation yields disclosure of information reachable from the gateway's network position or disruption of gateway availability, but no write access or code execution (I:N), so practical severity is bounded by what internal or cloud-metadata endpoints the appliance can actually reach - landing it in the medium operational-priority band despite the critical base score. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthenticated attacker who can deliver an inbound message cause the gateway to issue crafted HTTP requests to internal or otherwise unintended network destinations, with the trigger occurring during the gateway's issuer-certificate retrieval step. With CVSS 3.1 base score 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), a successful attack can disclose sensitive internal information reachable from the gateway's network position and/or disrupt gateway operation, but the practical impact is bounded by which internal services and metadata endpoints the gateway can reach and by whether any response data is reflected back to the attacker rather than being blind. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV), though the combination of network reachability, no authentication, and no user interaction makes this a genuine priority within the email security gateway niche.
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender to embed URLs in message content that the gateway then fetches server-side and reflects back, exposing internal services and cloud instance metadata to the attacker. Because the gateway processes inbound mail from untrusted senders as its normal operating mode, no credentials or user interaction are required beyond delivering a crafted message to a protected recipient, and the confidentiality impact is high whenever the appliance runs on a cloud instance with an attached IAM role. No public exploit code has been identified at time of analysis; the issue is nevertheless high priority given the unauthenticated network vector, with our independent assessment scoring integrity impact as Low (reflecting that state changes depend on which internal endpoint is reachable) rather than the published vector's High.
Unauthenticated server-side request forgery (SSRF) in Kiteworks Secure Data Forms before 9.5.0 allows remote attackers to force the server to issue arbitrary outbound network requests and read back the responses, exposing internal-only services, cloud metadata endpoints, and other network-restricted resources. Exploitation requires no authentication (PR:N) and no user interaction (UI:N); our independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting the high confidentiality impact of reading internal responses rather than the vendor's C:N/I:H weighting. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated server-side request forgery in Tugtainer before version 1.30.6 allows any logged-in user with access to notification settings to make the backend send outbound HTTP requests to attacker-chosen URLs through the /settings/test_notification endpoint, reaching localhost, RFC1918 ranges, and cloud metadata addresses such as 169.254.169.254. The urls field is passed directly to the Apprise notification library with no scheme, hostname, private-IP, or metadata filtering in the default configuration, and because responses are not returned to the caller the attack is blind, which limits it to internal port scanning, service probing, and indirect information inference rather than straightforward data exfiltration. Our independent assessment agrees with the SSRF class and the authentication prerequisite (PR:L) but rates the CIA impact lower (C:L/I:L/A:L) than the vendor's 9.1 scoring, so the practical severity sits below the headline score; vendor-released patch: 1.30.6, and no public exploit identified at time of analysis, with no CISA KEV listing.
Server-side request forgery (SSRF) in the management API endpoint of HPE Networking Instant ON access points lets an authenticated remote attacker who already holds high/administrative privileges pivot from the web interface to the underlying operating system, ultimately executing arbitrary commands as a privileged user. Devices running Instant On firmware version 3.4.1.0 and earlier are affected; the flaw is network-reachable with low attack complexity and full confidentiality, integrity, and availability impact (CVSS 3.1: 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but its practical reach is sharply limited by the PR:H prerequisite, meaning the attacker must first possess administrative credentials on the Instant ON management interface. No public exploit code or confirmed active exploitation was identified at time of analysis, and because exploitation is post-authentication, the realistic threat is an escalation-to-RCE step for an adversary who has already compromised or been granted AP administrator access.
Server-side request forgery (SSRF) in Joomla CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 allows an authenticated, high-privileged attacker to make the server issue requests to arbitrary URLs via improperly validated URLs in various core extensions. Exploitation requires a backend or administrator account and is not achievable by anonymous users; high attack complexity means a single reliable request is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in Stringer, a self-hosted RSS reader, allows an authenticated low-privileged user to make the server issue arbitrary HTTP/HTTPS requests to internal network hosts, loopback services, and cloud metadata endpoints such as AWS IMDS at 169.254.169.254. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, base 7.6) confirms a network-reachable, low-complexity attack requiring only an authenticated account - a barrier that collapses to near-anonymous when self-service signup (Setting::UserSignup) is enabled, since any visitor can register. Impact ranges from internal port and service scanning to theft of cloud IAM credentials when Stringer runs on a cloud instance with an attached role reachable via IMDSv1; there is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation, though the attack surface is trivial to exercise for anyone holding a valid session.
Axios versions 1.13.0 through 1.19.x on Node.js can silently bypass a configured HTTP(S) proxy or a caller-supplied DNS lookup policy for requests that opt into HTTP/2, because the HTTP/2 adapter calls http2.connect() without consistently applying config.proxy, environment-derived proxy settings, or config.lookup before the connection is established. This is a defense-in-depth control bypass (CWE-918, SSRF-adjacent): confidentiality and integrity impacts fall on the systems the bypassed egress or DNS control was meant to protect, not on the local vulnerable host, and exploitation is gated by non-default configuration - the application must explicitly set httpVersion: 2 and must actually depend on the proxy or lookup policy as a security boundary. Unauthenticated remote reachability is indicated by the CVSS vectors, but practical risk is moderate given the narrow affected version band and the opt-in requirement; no public exploit identified at time of analysis.
Server-side request forgery in fast-mcp-telegram prior to version 30.1 allows an authenticated MCP client (CVSS PR:L) to make the server fetch arbitrary internal HTTP(S) endpoints and receive the response body back as a Telegram file attachment. The send_message and send_message_to_phone tools accept URL lists that the server downloads via httpx.AsyncClient.get, but the _validate_url_security guard only inspects the literal hostname string and never resolves DNS, so any attacker-controlled domain that resolves to a loopback, private, or link-local address passes validation - even with the secure defaults block_private_ips=True and allow_http_urls=False. Because the fetched content is exfiltrated through the Telegram attachment rather than merely observed, this is a full-read SSRF; exploitation requires an authorized MCP session and a resolving hostname (raw private-IP literals remain blocked), and no public exploit code was identified at time of analysis.
Server-side request forgery in Apache Roller 6.1.5 allows an authenticated user holding entry-editing rights on a weblog to force the server to issue outbound HTTP requests to attacker-chosen destinations via the legacy outbound Trackback action and entry enclosure handling. No non-default configuration is required because the default Trackback allow-list is empty and therefore permits every destination, and although the Trackback control is hidden in the standard UI its Struts2 action remains directly reachable; requests can be aimed at loopback and private-network addresses, while the enclosure path additionally exposes response status, content type and length. CVE-2026-82375 carries a CVSS 3.1 score of 7.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, CWE-918) and no public exploit code was identified at time of analysis, with no confirmed active exploitation (CISA KEV); upgrading to Apache Roller 6.1.6 or later removes the outbound Trackback action and stops dereferencing enclosure URLs.
Server-side request forgery and local file inclusion in Regular Labs Modules Anywhere for Joomla (Pro versions 1.5.0 through 9.0.5) allow an attacker with content-authoring privileges to override module parameters and cause the server to open attacker-influenced URLs or local files. The parameter-override feature is enabled by default and applies attributes without verifying who authored the content containing the module tag; Joomla's core Feed module with its rssurl parameter is a confirmed vector. The vendor rates this 8.5 under CVSS 4.0, but the independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) indicates high technical impact with moderate real-world priority because authentication is required and exposure depends on the selected module; no public exploit was identified at time of analysis.
Server-side request forgery in Obot through v0.22.1 allows an authenticated user holding the Power User, Power User Plus, or Admin role to register a remote MCP server pointing at an arbitrary URL, which Obot then fetches server-side with no destination validation. Because the fetched response is reflected back in Obot's error messages, this is a non-blind SSRF: the attacker can read responses from internal services and, against the cloud metadata endpoint 169.254.169.254, potentially obtain the host's cloud IAM credentials and pivot into the cloud account. Exploitation is role-gated and requires authentication to be enabled with privileged users permitted to register remote MCP servers; there is no public exploit identified at time of analysis, and the issue is fixed in v0.23.0.
python-utcp versions before 1.1.4 allow server-side request forgery through the utcp-http plugin's HttpCommunicationProtocol.call_tool, which validates the initial tool URL but follows HTTP redirects with no per-hop re-validation, so an attacker-controlled tool endpoint can return a 3xx Location that drives the UTCP client into internal HTTP services or the cloud metadata endpoint (169.254.169.254) and returns the response body to the tool caller. The vulnerable path is the core UTCP pattern of registering a tool or manual/OpenAPI spec from a runtime-supplied URL and then invoking it; the initial URL only needs to pass ensure_secure_url (any https:// or a benign attacker-owned host), with the attacker supplying the redirect. Exploitation is remote and requires no privileges (CVSS 4.0 PR:N, assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), but it is gated on the host ingesting and invoking an attacker-influenced tool spec and on an internal HTTP service being reachable from the client, which keeps practical priority moderate rather than critical; no public exploit code was identified at time of analysis and the issue is not in CISA KEV. Vendor-released patch: 1.1.4.
Credential exfiltration and server-side request forgery in utcp-http 1.1.3 and earlier allow an attacker who supplies a malicious OpenAPI specification to redirect a victim's OAuth2 client_id and client_secret to an arbitrary token endpoint. The library validates discovery and tool-invocation URLs via ensure_secure_url() but never applies the same guard to the OAuth2 tokenUrl taken from a remote spec, so the attacker-chosen endpoint receives the credentials in cleartext when a generated OAuth2-protected tool is invoked. Exploitation requires victim interaction (the victim must register the attacker-controlled spec and call the generated tool) and no attacker authentication; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N (7.1), with the unvalidated endpoint also usable for SSRF against internal HTTP ranges. No public exploit identified at time of analysis.
Server-side request forgery in python-utcp (utcp-http) before 1.1.12 allows an unauthenticated remote attacker to cause a victim's client to issue requests to loopback services and return response bodies if the victim registers a malicious UTCP manual served from a non-loopback origin. Exploitation requires user interaction (registering the manual) and is limited to loopback interfaces, with further prerequisites of a loopback service that answers unauthenticated requests with useful data. No public exploit code exists, and the issue is fixed in utcp-http 1.1.12; this is a conditional-severity issue rather than a mass-exploitation threat.
Credential exfiltration in Heym before version 0.0.106 allows an authenticated collaborator who has been granted shared access to a credential to cause the server to transmit the credential owner's decrypted secret to an attacker-controlled endpoint. The flaw lives in the POST /api/credentials/test endpoint, where the destination URL supplied in the config parameter is not validated, so a low-privileged collaborator can redirect a credential-verification request (CWE-918 server-side request forgery) and harvest plaintext secrets they were never entitled to read. The vendor CVSS 4.0 assessment (7.1, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) confirms high confidentiality impact with no integrity or availability effect, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; risk is concentrated in multi-user, self-hosted deployments that rely on collaborator sharing, while single-user instances are not meaningfully exposed.
Non-blind server-side request forgery in heym (heymrun) before 0.0.109 lets any registered user redirect backend HTTP requests to loopback, private, link-local, or cloud-metadata addresses and read the full response body in the workflow node output. The flaw is confined to the Slack, Discord, and Crawler workflow nodes, which build requests from user-supplied credential URLs (webhook_url / flaresolverr_url) with an unguarded HTTP client that bypasses the SSRF egress guard already enforced on the HTTP, WebSocket, and MCP nodes. No public exploit code or confirmed active exploitation was identified at time of analysis, but exploitation requires only a valid account (PR:L) on an affected instance and no user interaction; the fixed release is 0.0.109.
Server-side request forgery in AzuraCast before 0.23.8 allows an authenticated user with the station-scoped WebHooks permission to make the server send outbound HTTP POST requests to internal, loopback, or RFC1918 addresses through the Generic and Discord webhook connectors. The AbstractConnector::getValidUrl() validation only rejects literal link-local IPs and skips validation entirely when the hostname is not a literal IP, and the same user can trigger the request on demand via the webhook test endpoint. No public exploit identified at time of analysis; risk is moderate because exploitation requires a low-privileged account and impact is largely a blind Now Playing POST unless the target internal service is reachable and responsive.
Server-side request forgery in AzuraCast (Composer package azuracast/azuracast, versions before 0.23.8 per the advisory) lets an authenticated user who holds the station-scoped RemoteRelays permission set a station's Remote Relay URL to loopback, private-network, or cloud-metadata addresses such as http://127.0.0.1:<port>/ or http://169.254.169.254/latest/meta-data/. Because the URL is validated only for syntax and an http/https scheme, the platform's periodic background Now Playing sync (AbstractRemote::getNowPlayingAsync) then automatically and repeatedly fetches that attacker-chosen address on the server's behalf, yielding blind SSRF against internal services and - on cloud-hosted instances with a reachable metadata endpoint - potentially exposing instance credentials or configuration. This is not an unauthenticated internet-facing flaw: exploitation requires an authenticated account with the RemoteRelays permission (PR:L in both the vendor's CVSS 4.0 vector and our CVSS 3.1 assessment), there is no public exploit code identified at time of analysis, and no patched release was confirmed at the time of the advisory.
Server-side request forgery in Kyverno before 1.19.1 lets a user who can author a ClusterPolicy or GlobalContextEntry with a non-CEL context[].apiCall.service call force the admission controller to issue GET/POST requests to an arbitrary destination, including cloud metadata endpoints, loopback, and any in-cluster service, thereby reading cloud instance credentials and reaching internal endpoints from Kyverno's network position. The vulnerable legacy executor and the GlobalContextEntry external-API path use a plain net/http client with no egress blocklist and no validation of the configured service URL, and they unconditionally attach Kyverno's projected ServiceAccount token to the attacker-chosen destination (the token is audience-scoped, limiting replay value). Exploitation requires high privileges because the attacker must already be able to write cluster-scoped policy objects (PR:H); the bar drops to a lower-privileged resource submitter only in the non-default case where a deployed policy templates the service URL from the admission resource. There is no public exploit identified at time of analysis, and the vendor rates the issue 8.3 (High) under CVSS 4.0.
Server-side request forgery in OpenClaw (npm package 'openclaw') before 2026.8.1 lets an attacker who can influence DNS for an already-allowlisted hostname bypass the trusted-host destination validation and reach a service bound only to loopback, disclosing that service's response. Exploitation is highly conditional and high-complexity: the fetch must go through the trusted-host DNS recheck path, the hostname must already be on the trusted-host allowlist, the attacker must be able to make it resolve to an unspecified address (0.0.0.0 or ::), and a loopback-bound service must actually exist and return useful data - impact is confidentiality-only. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor shipped a fix in 2026.8.1.