SSRF

Server-side request forgery in Memos through 0.30.0 allows unauthenticated remote attackers to make the application's link-metadata fetcher issue HTTP requests to hosts in the 100.64.0.0/10 carrier-grade NAT address space, a range the application's IP blocklist incorrectly omits. The server returns page titles and HTML meta descriptions from targeted internal hosts, enabling partial reconnaissance of CGNAT-addressed infrastructure. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Server-Side Request Forgery in MITRE SAF Heimdall 2.11.6 through 2.13.x allows unauthenticated remote attackers to reach internal network hosts by supplying an arbitrary host_url parameter to the Tenable proxy endpoint, which the backend forwards without validation. The root cause is the absence of both authentication guards and URL allowlist enforcement on the /tenable proxy route, as confirmed by the fix commit adding JwtAuthGuard and an origin-based allowlist. No public exploit code and no CISA KEV entry are identified at time of analysis, limiting immediate real-world risk despite the network-accessible, no-authentication attack vector.

Unauthenticated XML External Entity (XXE) injection in MapFish Print's GML layer parser allows remote attackers to read arbitrary server-side files and conduct server-side request forgery (SSRF) via a single crafted HTTP POST to the /api/print3/print endpoint. All 3.x branches prior to 3.28.30, 3.30.32, 3.31.24, and 3.33.16, as well as 4.x prior to 4.0.5, are affected. A fully functional proof-of-concept exploit has been publicly disclosed in the GitHub Security Advisory GHSA-5v29-34h8-v68r, enabling exfiltration of Kubernetes service account tokens, OS credential files, and TLS certificates with no authentication required.

Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated low-privilege attacker to coerce the application server into issuing arbitrary outbound HTTP requests, enabling internal network enumeration and potentially pivoting to other attacks against backend infrastructure. The CVSS vector (PR:L/AV:N/AC:L) confirms this is exploitable over the network by any authenticated user without elevated permissions or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via their support portal.

SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis.

Server-Side Request Forgery in Gitingest through 0.3.1 allows unauthenticated attackers to redirect outbound server connections to arbitrary attacker-controlled hosts by exploiting a prefix-only hostname validation bypass in the `_validate_host` function. Because Gitingest may carry GitHub personal access tokens as HTTP basic auth credentials on outbound git requests, any host whose name begins with `git.`, `gitlab.`, or `github.` passes validation and becomes a credential harvesting endpoint. No public exploit code is confirmed at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.3 reflects the combination of low attack complexity, unauthenticated access, and high confidentiality impact.

Unauthenticated SSRF in DataElement bisheng through 2.6.0-fix2 exposes internal network services and cloud metadata endpoints to any internet-accessible attacker. The POST /api/v1/workflow/report/callback endpoint applies no authentication, no URL scheme restrictions, and no host filtering, allowing arbitrary server-side HTTP requests whose responses are retrievable from object storage via caller-controlled object names - enabling cloud credential theft (e.g., AWS IMDSv1 role keys) and internal network enumeration. No public exploit code has been identified and this CVE is not in CISA KEV at time of analysis.

Server-side request forgery in Portkey AI Gateway through version 1.15.2 enables unauthenticated remote attackers to weaponize the gateway as an internal network proxy by injecting arbitrary host values into the x-portkey-custom-host header on the /v1/proxy/* route, which lacks requestValidator middleware. The gateway faithfully forwards outbound requests - including Authorization headers carrying LLM provider API keys - to attacker-specified internal addresses, enabling credential exfiltration and internal service enumeration. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated, low-complexity nature of the attack vector makes this an urgent remediation priority for any internet-exposed gateway deployment.

Server-side request forgery in Qwen-Agent through 0.0.34 allows unauthenticated remote attackers to exfiltrate data from internal infrastructure by exploiting the document parsing path's failure to validate caller-supplied URLs. The Gradio interface - exposed without authentication by default - serves as the entry point, enabling attackers to direct the server to issue HTTP requests to cloud metadata endpoints such as AWS IMDSv1 or GCP metadata APIs and retrieve responses through the document parsing output. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-privilege, zero-interaction attack vector against credential-bearing metadata services makes this a high-priority risk for any cloud-hosted deployment.

Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API credentials to read responses from arbitrary internal network services by supplying attacker-controlled URLs as the OIDC SSO connector issuer parameter. The vulnerable surface extends beyond the SSO connector endpoint to webhook delivery and SAML IdP metadata fetching, each of which accepted tenant-supplied URLs without filtering loopback, RFC 1918, or cloud metadata (169.254.169.254) destinations. No public exploit identified at time of analysis; a patch is available upstream via commit 16f4b2e7.

Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API tokens to direct the server to issue HTTP POST requests to arbitrary internal URLs via the POST /api/hooks/:id/test webhook-test endpoint, then read response bodies from private-network services back through the API error payload. The flaw stems from the absence of host validation in the webhook delivery library (packages/core/src/libraries/hook/utils.ts) and extends beyond webhooks to enterprise SSO connector discovery and SAML metadata fetching. A patch is available via upstream commit 16f4b2e and no public exploit code or CISA KEV listing has been identified at time of analysis.

Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network client coerce the pipeline UI backend into making arbitrary HTTP/HTTPS requests to internal targets via the /_proxy/ route. Because the route sits outside the authorization middleware even when ENABLE_AUTHZ=true, attackers can reach cloud metadata endpoints, the Kubernetes API, and other cluster-internal services, forwarding chosen methods, Authorization/Cookie headers, and POST bodies while receiving the upstream response. No public exploit identified at time of analysis, but the CVSS 10.0 rating and default reachability make this a critical priority for any exposed Kubeflow deployment.

Server-Side Request Forgery in the Everest Forms WordPress plugin (all versions up to and including 3.4.4) enables unauthenticated remote attackers to force the WordPress server to issue arbitrary outbound HTTP HEAD requests to attacker-controlled URLs. The flaw resides in the plugin's upload field handling: when a form submission triggers re-rendering due to a missing required field, unsanitized POST-supplied URLs are passed directly to WordPress's `wp_remote_head()` without any domain restriction. No active exploitation has been confirmed by CISA KEV, though the zero-authentication requirement and WordPress's broad deployment footprint elevate practical risk for internal network reconnaissance and cloud metadata endpoint probing.

Server-side request forgery in Budibase Server before 3.41.3 allows authenticated low-privileged users to abuse the query import endpoint, directing the server to fetch arbitrary attacker-supplied URLs - including cloud instance metadata endpoints such as AWS IMDSv1 (169.254.169.254) and equivalent GCP and Azure services. The attack is network-reachable with low complexity and no user interaction required, making it reliably exploitable by any authenticated Budibase user in cloud-hosted deployments where temporary credentials are accessible via metadata APIs. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Server-side request forgery in Budibase Server before 3.41.3 allows authenticated builder-level users to supply arbitrary URLs to the datasource verify endpoint without SSRF validation, causing the server to make outbound requests to attacker-controlled infrastructure. The primary impact is credential leakage: internal CouchDB connection credentials are exposed in those outbound requests, granting an attacker direct, full administrative access to the backend database. This risk is amplified in cloud deployments where CouchDB serves as the primary data store. No public exploit code or CISA KEV listing is identified at time of analysis.

Server-Side Request Forgery in Budibase Server self-hosted deployments exposes internal services on the RFC 6598 shared address space (100.64.0.0/10) by omitting that range from the default SSRF blacklist (DEFAULT_BLACKLIST) used for REST datasource query preview requests. Authenticated users holding the Builder role can submit a crafted POST /api/queries/preview request targeting a reachable host in 100.64.0.0/10, causing the Budibase server to proxy the request and return the internal service response through the preview flow, potentially exposing confidential internal data. No released patch has been identified; exploitation requires Builder-role access and a self-hosted deployment without a custom BLACKLIST_IPS override. No public exploit or CISA KEV listing has been identified at time of analysis.

SiYuan before v3.8.1 exposes a DNS rebinding SSRF vulnerability in its http_request and web_fetch agent tools, allowing network-accessible attackers who can influence processed URLs to bypass the built-in SSRF IP-blocklist defense and reach cloud instance metadata services or internal network hosts. The guard-time-only DNS resolution creates a TOCTOU race: the SSRF check sees a legitimate public IP, but the actual TCP connection lands on 169.254.169.254 or another private address. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS 4.0 score of 8.4 reflects high downstream confidentiality risk for cloud-hosted deployments where metadata credentials are accessible.

Server-Side Request Forgery in Synology Chat Server's webhook functionality allows remote authenticated users to probe internal or external network resources and retrieve non-sensitive information. Affected versions are all Chat Server releases prior to 2.4.5-22148. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the authenticated network attack vector and low complexity make this straightforward to exploit for any valid user of the application.

Server-Side Request Forgery in wallabag 2.x through 2.6.14 enables authenticated users to coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via a maliciously crafted article title or content field that is processed during PDF export. The scope change in the CVSS vector (S:C) reflects that the SSRF escapes the wallabag application boundary and can reach backend services, cloud metadata endpoints, or internal network hosts invisible to the attacker directly. A separate full-disclosure post references this same advisory with a higher CVSS score of 8.5 and also mentions a Stored XSS vector, suggesting the attack surface may be broader than the NVD 6.4 score implies. No public exploit identified at time of analysis.

Server-side request forgery in WatchGuard Dimension's Email Server Test configuration feature enables authenticated privileged attackers to probe and enumerate network services on adjacent network segments. The vulnerability stems from insufficient validation of server-initiated outbound requests, allowing the Dimension management platform to be weaponized as a network scanning proxy. No public exploit code has been identified at time of analysis, and the attack requires high-privilege credentials, materially limiting realistic exposure.

Server-side request forgery in WatchGuard Dimension's Remote Backup Connection Test configuration feature allows authenticated privileged users to enumerate exposed network services on adjacent systems. The CVSS 4.0 score of 5.3 reflects confined impact - no direct compromise of the Dimension host itself, but meaningful secondary-system reconnaissance capability. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Server-side request forgery in WatchGuard Dimension's FTP Server Test configuration feature allows a privileged authenticated attacker to probe and enumerate network services on adjacent network systems. The vulnerability affects all tracked versions of WatchGuard Dimension (CPE wildcard) and is limited to subsequent-system confidentiality impact - specifically service discovery on internal or adjacent hosts. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.

Blind server-side request forgery in WatchGuard Dimension's Database Server Test configuration feature allows an authenticated privileged attacker to enumerate network services on adjacent systems by exploiting observable timing or response discrepancies (CWE-208). The scope of impact extends beyond the Dimension host itself to adjacent network segments, enabling internal network reconnaissance without direct access to those systems. No public exploit is identified at time of analysis, and the high privilege requirement substantially limits the realistic attacker pool.

Server-side request forgery in scrapling-fetch-mcp versions through 0.2.2 allows an authenticated user of an MCP-enabled AI assistant to supply arbitrary URL schemes - such as file://, gopher://, or dict:// - to the s_fetch_page and s_fetch_pattern tool functions, causing the server to issue requests to internal or local resources on behalf of the attacker. The root cause is the absence of any URL scheme validation before passing user-controlled input to the underlying browse_url call in _fetcher.py. No public exploit code or active exploitation has been identified; version 0.2.3 patches the issue.

Spring Cloud Function versions across three actively maintained release lines (4.2.x, 4.3.x, and 5.0.x) are affected by a potential arbitrary file read and SSRF vulnerability reported by VMware. The vendor-assigned CVSS 3.1 score of 2.0 reflects severe constraints on exploitability - high privilege requirements (PR:H), required user interaction (UI:R), and high attack complexity (AC:H) together make opportunistic or unauthenticated exploitation implausible. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.

Incomplete NAT64 prefix filtering in CC: Tweaked prior to 1.120.0 allows any Lua-capable Minecraft player on a dual-stack server to bypass SSRF protections and reach loopback, RFC 1918, cloud metadata, or internal API endpoints. The flaw resides in AddressPredicate.java, which correctly blocks the RFC 6052 Well-Known NAT64 prefix (64:ff9b::/96) but omits the RFC 8215 Local-Use prefix (64:ff9b:1::/48), enabling requests via http.request or http.websocket to mapped internal IPv4 addresses. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation requires a non-default dual-stack NAT64 deployment.

Server-Side Request Forgery (SSRF) in GitLab's AI Gateway component allows an authenticated user with Duo Agent Platform access to redirect outbound model requests to an attacker-controlled endpoint by injecting a crafted inline flow configuration that overrides the HTTP Host header. Exploitation results in exfiltration of Google Cloud Vertex cloud service credentials and private signing keys held by the AI Gateway, enabling an adversary to subsequently authenticate to GCP services outside GitLab's control. No public exploitation (CISA KEV) has been confirmed, but a publicly available exploit exists via a disclosed HackerOne report, materially increasing real-world risk.

Server-Side Request Forgery (SSRF) in GitLab AI Gateway allows authenticated users with Duo Agent Platform access to exfiltrate Google Vertex AI or AWS Bedrock cloud service credentials by injecting a malicious endpoint into crafted model metadata, causing the gateway to proxy requests - including cloud credentials - to an attacker-controlled server. All AI Gateway releases from 18.9.0 through 19.2.2 are affected across three version branches; GitLab has confirmed remediation. A public exploit exists per the HackerOne reference, and the CVSS Scope Change metric (S:C) reflects that successful exploitation extends compromise to external cloud infrastructure beyond the GitLab instance itself.

Server-side request forgery in AVideo before 24.0 allows unauthenticated network attackers to bypass SSRF protections in the isSSRFSafeURL function by encoding private IPv4 targets inside NAT64, 6to4, or Teredo IPv6 transition address formats. The LiveLinks proxy endpoint serves as the attack surface, enabling requests to reach internal network services and cloud instance metadata endpoints (e.g., 169.254.169.254 equivalents) that should be unreachable. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis; however, the unauthenticated network vector and patch availability make this a straightforward prioritization for any AVideo operator.

Server-Side Request Forgery in Apify actors-mcp-server allows any MCP caller to make the server fetch arbitrary internal URLs, including cloud instance metadata endpoints, exposing IAM credentials. The get-html-skeleton tool's URL validation in src/tools/common/get_html_skeleton.ts accepted any syntactically valid http/https URL without inspecting the destination hostname or resolved address, permitting requests to loopback, link-local, and RFC 1918 ranges. The CVSS 4.0 score of 8.7 with PR:N reflects unauthenticated exploitation; no public exploit is identified at time of analysis, and the issue is resolved in version 0.9.12 by removing the tool entirely.

Unauthenticated SSRF in mcp-use's inspector proxy middleware allows any network-reachable caller to coerce the server into issuing HTTP requests to loopback, link-local, and RFC-1918 private addresses - including cloud instance metadata endpoints - and read the responses. The root cause was mountMcpProxy accepting attacker-supplied destinations via the X-Target-URL header or __mcp_target parameter without host validation, and failing to revalidate the resolved address after a server-side redirect. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H) reflects full confidentiality impact exploitable by any unauthenticated network caller; no public exploit is identified at time of analysis, and the vendor has shipped a fix via the isSafeProxyTarget guard.

Client-metadata injection in Spring Security's OAuth2 Authorization Server module (7.0.0 through 7.0.4) lets an attacker holding a valid Initial Access Token register a malicious OAuth2 client whose insufficiently validated metadata can yield Stored XSS, Privilege Escalation, or SSRF. Exploitation requires that the optional Dynamic Client Registration (DCR) endpoint be explicitly enabled, and the concrete impact depends on how the server later renders or consumes the stored metadata. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-rated CVSS of 9.6 reflects a scope-changing, high-confidentiality/high-integrity outcome.

Header type injection in Spring for Apache Kafka's default mapper configuration allows any Kafka producer with access to a consumed topic to inject java.net.InetAddress objects through the spring_json_header_types message header, triggering DNS resolution on the consumer host. All applications using @KafkaListener with the default JsonKafkaHeaderMapper or DefaultKafkaHeaderMapper - spanning versions 2.8.x through 4.1.0 - are affected without any non-default configuration required. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Server-side request forgery and remote code execution affect the Spring Framework's XsltView component across the 5.2.x through 7.0.x branches (5.2.25.RELEASE and earlier, 5.3.0-5.3.49, 6.0.0-6.0.30, 6.1.0-6.1.28, 6.2.0-6.2.19, and 7.0.0-7.0.8). When a Spring MVC application maps '/**' to view rendering and does not explicitly set a view name, an attacker can steer view resolution to XsltView and supply a path that triggers outbound requests and code execution. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%), but SSVC rates the technical impact as total and automatable.

Spring Cloud Gateway's JsonToGrpcGatewayFilterFactory permits an authenticated administrator to supply arbitrary Spring Resource location strings when defining the proto descriptor file. The gateway subsequently resolves these locations without restriction, enabling access to sensitive internal file paths, classpath resources, or remote endpoints via SSRF-like traversal - effectively granting the admin-level attacker read and potential integrity impact on systems beyond the gateway's own scope. No public exploit code or CISA KEV listing exists at time of analysis, but the scope-changed CVSS vector (S:C with C:H/I:H) and the breadth of affected version lines (3.x through 5.x) make this a meaningful risk in enterprise Spring microservice architectures.

Spring Integration's UDP inbound adapter can be abused by unauthenticated remote attackers to coerce the server into emitting outbound UDP datagrams to arbitrary hosts and ports - a classic UDP Server-Side Request Forgery (SSRF). Affected versions span the entire supported line from 5.5.x through 7.1.0, covering a wide range of enterprise Java deployments. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (single crafted UDP packet) makes this straightforward to weaponize once the adapter port is located.

Server-side request forgery in ddfourtwo sentry-selfhosted-mcp 0.4.0 allows remote unauthenticated attackers to manipulate the endpoint argument in the raw_sentry_api component, causing the server to issue arbitrary HTTP requests to internal or external hosts. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public exploit exists via a GitHub issue report. No patch has been released - the project maintainer has not responded to the coordinated disclosure.

Server-side request forgery in JetLinks Community 2.11 lets attackers abuse the device metadata import endpoint (/device/instance/{productId}/property-metadata/import) to coerce the server into issuing arbitrary outbound requests. Because the platform sits at the IoT control layer, this can be used to reach internal-only services, cloud metadata endpoints, and other network-segment resources normally shielded from the internet. A public write-up/POC exists (GitHub) and SSVC rates the flaw as automatable with total technical impact, though EPSS remains low (0.14%) and it is not on CISA KEV, so no public exploit identified at time of analysis as active exploitation.

Server-side request forgery in Zyplayer-Doc version 1.0.0 and earlier lets remote unauthenticated attackers coerce the server into issuing arbitrary outbound requests through the WikiPageWebService.download() function. Because the wiki page download feature fetches attacker-controlled URLs without validation, an attacker can reach internal-only services, cloud metadata endpoints, and other back-end systems the server can see. Publicly available exploit code exists (a GitHub write-up), CVSS is rated 9.1, and SSVC flags the flaw as automatable with total technical impact, though it is not listed in CISA KEV.

Missing authentication on KubePi's SSO configuration endpoints (versions up to and including 1.6.15) lets unauthorized or low-privileged users read, create, and modify the global SSO/OIDC/SAML authentication configuration because those management routes share the public routing boundary with the SSO login/callback endpoints. An attacker can inspect or tamper with authentication settings - potentially leading to account takeover or privilege escalation - abuse the SSO connectivity-test as an SSRF primitive, and harvest authentication-related fields leaked by the user-list API. There is no public exploit identified at time of analysis; the issue is fixed in KubePi 2.0.0.

Server-side request forgery in HCL Connections allows a low-privileged, authenticated attacker - operating from or through a compromised internal server - to issue unauthorized outbound requests to internal resources, resulting in limited information disclosure or potential security control bypass. The vulnerability carries a low CVSS base score of 3.7 due to high attack complexity, required user interaction, and unchanged scope, and no public exploit or CISA KEV listing exists at time of analysis. Risk is constrained by the prerequisite of a pre-compromised internal host, making this a meaningful lateral-movement enabler rather than a direct initial-access vector.

DNS rebinding SSRF in Weblate prior to version 2026.8 allows an authenticated user with VCS component URL management privileges to circumvent VCS_RESTRICT_PRIVATE protections and reach internal network services. The attack exploits the time gap between Weblate's initial hostname validation and the VCS client's subsequent independent DNS lookup - an attacker-controlled domain passes validation pointing to a public IP, then switches to an internal address before the actual VCS connection is made. Triggering a clone, fetch, push, or similar operation then causes Weblate to connect to internal VCS-compatible services and potentially expose their contents. No public exploit has been identified at time of analysis, though the DNS rebinding technique is well-understood and toolkits for it exist.

Server-Side Request Forgery in Dell Cloud Disaster Recovery versions 20.2 and prior enables a low-privileged authenticated remote attacker to coerce the server into making arbitrary outbound HTTP requests, with limited confidentiality impact per the vendor-confirmed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vulnerability is documented in Dell advisory DSA-2026-353 and affects all releases up to and including version 20.2. No public exploit code has been identified and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.

Server-side request forgery in OneUptime's webhook delivery subsystem allows an authenticated project member to bypass the SSRF protection filter by supplying an IPv4-mapped IPv6 address literal such as [::ffff:127.0.0.1], directing the server to connect to loopback services, private network ranges, or cloud metadata endpoints. All OneUptime versions prior to 12.0.7 are affected; the underlying HTTP client treats the mapped form as the embedded IPv4 address, and the webhook response is returned to the attacker. No public exploit has been identified at time of analysis, but the bypass technique is well-documented in SSRF filter evasion literature and requires no special tooling.

Server-Side Request Forgery in mcp-fetch through version 1.6.3 allows unauthenticated attackers who can influence model tool arguments to bypass the SSRF guard entirely and reach loopback, private, and link-local network endpoints including cloud instance metadata services. The bypass exploits a parsing gap: the guard tests the bracketed IPv6 literal string such as [::1] against Node.js's net.isIP(), which returns zero for bracketed input, causing the private-address branch to be skipped; the HTTP client later strips the brackets and connects normally. A secondary flaw in isPrivateIPv6 - no handling of the ::ffff: IPv4-mapped prefix - provides an independent bypass path for IPv4 targets expressed in mapped form. No public exploit code or CISA KEV listing exists at time of analysis, though a public issue report documenting the flaw is open on the upstream repository.

Blind SSRF in Chainlit's MCP endpoint allows unauthenticated remote attackers to force the server to issue outbound HTTP requests to arbitrary internal or external URLs - including cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) - with fully attacker-controlled HTTP headers including Authorization and Cookie. Affected versions span 2.4.0rc0 through 2.11.x; the amplified form with attacker-controlled header forwarding affects 2.6.4 through 2.11.x, enabling state-changing authenticated requests against internal APIs without requiring any response read-back. Publicly available exploit code exists, confirmed against Chainlit 2.11.0 by SPL Security researchers; no CISA KEV listing is present at time of analysis.

Server-side request forgery in Dradis Community Edition 5.1.0-5.2.0 allows any authenticated non-admin user to hijack the AI provider configuration and redirect server-initiated HTTP requests to arbitrary URLs, including internal cloud metadata endpoints such as 169.254.169.254. A broken authorization gate in ProvidersController and AgentsController is conditioned on the Ruby constant Dradis::Pro, which is never defined in CE builds, so the admin_required filter is silently skipped for all CE installations. Non-2xx responses from attacker-supplied URLs are reflected verbatim to the attacker's browser via ActionCable/Turbo Stream, enabling exfiltration of internal service content. No public exploit code or CISA KEV listing has been identified at time of analysis.

Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the running user, giving an unauthenticated network attacker full control per Adobe's CVSS:3.1 base score of 10.0 (scope-changed). The flaw lets an attacker coerce the server into making attacker-controlled requests that pivot into code execution with no user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the only reference is an Adobe advisory (APSB26-134) served from an internal, non-public host and could not be independently verified.

Server-side request forgery in JFrog Artifactory's External Dependency feature allows a low-privileged authenticated user to trigger outbound HTTP requests from the Artifactory server to remote CocoaPods repositories under specific high-complexity conditions. The CVSS scope change (S:C) indicates the forged requests escape the Artifactory application boundary, creating potential for internal network probing from the server's network position. No public exploit code exists and no active exploitation has been confirmed; no KEV listing is present at time of analysis.

Server-Side Request Forgery (SSRF) in JFrog Artifactory allows a low-privileged authenticated user with read access to a remote VCS repository to replace the repository's configured origin URL or supply an arbitrary absolute VCS data URL, causing Artifactory's server process to issue outbound HTTP requests to attacker-controlled destinations - including internal network services, cloud metadata endpoints, or other infrastructure inaccessible from the public internet. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Artifactory itself to systems on its internal network segment. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Server-Side Request Forgery in PraisonAI's Jobs API (pip/praisonai < 4.6.58) results from two compounding flaws: a fail-open DNS error handler in `JobSubmitRequest.validate_webhook_url()` that silently accepts any webhook URL when `socket.gaierror` is raised, and a TOCTOU race where `JobExecutor._send_webhook()` performs a completely independent DNS resolution via `httpx.AsyncClient` minutes to hours after validation. Authenticated attackers with a valid API bearer token can submit a job whose `webhook_url` hostname returns NXDOMAIN at validation time, then update DNS to a private IP before job completion, causing the executor to POST job result data to internal infrastructure. A detailed proof-of-concept is publicly available in GHSA-rg5q-pp8p-f7jm; no public exploit identified at time of analysis beyond the PoC, and this CVE is not listed in CISA KEV.

Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding namespace management permissions to redirect a background worker process into probing arbitrary internal network addresses, including loopback interfaces and cloud instance metadata endpoints (e.g., 169.254.169.254). The dual-impact vulnerability enables both internal network reconnaissance (enumerating reachable IPs and reading service responses) and a denial-of-service condition against background workers due to the absence of an HTTP client timeout. No public exploit has been identified at time of analysis, and no confirmed KEV listing exists; however, the scope-changing CVSS vector (S:C) reflects that impact crosses trust boundaries from the application into adjacent internal infrastructure.

Server-Side Request Forgery in praisonaiagents (pip package, versions < 1.6.58) allows any attacker who can influence an AI agent's crawl target - via crafted task instructions or prompt injection embedded in previously crawled content - to exfiltrate cloud instance metadata (including IAM credentials), internal localhost services, and RFC1918 API endpoints. The web_crawl tool's SSRF protection validates only the initial URL's hostname IP, then invokes httpx with follow_redirects=True, allowing an attacker-controlled public URL to 302-redirect the agent to 169.254.169.254 or 127.0.0.1 without any re-validation. This is an incomplete fix for a prior SSRF class in the same component. A fully functional proof-of-concept is publicly documented in GHSA-5r34-2g38-6569, and no public exploit identified at time of analysis beyond the PoC; no CISA KEV listing is present.

Server-side request forgery in Ech0 through 4.2.1 (Go-based self-hosted application by lin-snow) allows an authenticated admin to exfiltrate data from internal network services and cloud metadata endpoints by exploiting a DNS resolution bypass in webhook URL validation. The validateWebhookURL function checks only literal IP strings via net.ParseIP(), so hostnames like 169.254.169.254.nip.io pass validation unchallenged and DNS-resolve to private IPs at request time. Publicly available exploit code exists (curl-based PoC in GHSA-r2x7-427f-rq69); no confirmed active exploitation (not in CISA KEV). The CVSS 4.0 score of 5.1 reflects the PR:H prerequisite, which substantially limits real-world exposure.

Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application server to reach internal infrastructure, including cloud provider metadata APIs and Kubernetes service endpoints. The root cause is a missing URL-validation call: `fetchPeerConnectInfo` in `internal/service/connect/connect.go` invokes the unguarded `SendRequest` helper rather than the `SendSafeRequest` variant that enforces `ValidatePublicHTTPURL` private-IP blocking. A working proof-of-concept demonstrating AWS IMDSv1 and Kubernetes API enumeration is publicly available in the GHSA advisory; no active exploitation via CISA KEV has been confirmed, though the CVSS 4.0 score of 8.3 with SC:H reflects elevated impact potential for cloud-hosted deployments.

Server-side request forgery in Apache Hive versions 2.1.0 through 4.2.0 lets an authenticated user with CREATE TABLE rights coerce the HiveServer2/Metastore process into fetching an attacker-chosen URL by planting a crafted avro.schema.url table property on an Avro table that is later queried. The fetch runs with the Hive service identity, exposing cloud instance metadata (e.g. 169.254.169.254), internal-only network services, and local files. No public exploit is identified at time of analysis and EPSS is low (0.29%), but the CVSS 9.1 rating and low attack complexity make it a meaningful post-authentication risk; upgrade to 4.2.1 resolves it.

Server-side request forgery in NLTK before 3.10.3 allows unauthenticated remote attackers to reach internal HTTP services and load attacker-controlled downloader indexes when an HTTP proxy is configured. The flaw sits in nltk.pathsec.urlopen and its callers (nltk.data.load, nltk.downloader.Downloader.index, nltk.downloader.Downloader.download): local hostname validation passes the supplied public URL, but proxy-handler inheritance then replaces NLTK's safe URL handlers so the actual fetch is executed by the proxy against an internally-resolvable destination that is never re-validated. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score is 8.7, reflecting high confidentiality impact under network-accessible, unauthenticated conditions.

Server-side request forgery in the Grav API plugin before version 1.0.16 allows an attacker who controls authoritative DNS for a configured webhook hostname to reach private internal network resources from the Grav server. The flaw exploits a TOCTOU race (CWE-367) between hostname validation and HTTP delivery: validation resolves the hostname to a legitimate public address, but a DNS rebind before delivery redirects the actual request to an RFC1918 address. No public exploit has been identified at time of analysis and the vulnerability has not been confirmed in CISA KEV.

Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal hosts and ports by injecting PDO DSN keys into the login form's server parameter. The root cause is an incomplete port-validation routine that only inspects leading numeric characters, failing to reject non-numeric port values; a crafted server string such as 'host=internal.host port=6379' bypasses the privileged-port restriction entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the pre-authentication nature and low attack complexity make this an attractive reconnaissance primitive against Adminer deployments exposed to untrusted networks.

DNS-based server-side request forgery in jackson-databind exposes any Java application that deserializes user-supplied JSON into objects containing `java.net.InetAddress`-typed fields, causing the library to perform unsolicited outbound DNS lookups against attacker-controlled hostnames. Affected across all major release lines from 2.x through 3.x (com.fasterxml and tools.jackson.core artifact groups), the flaw allows unauthenticated remote attackers to enumerate internal hostnames and map internal network topology via DNS side-channels. No active exploitation or public exploit code has been identified; vendor patches are available across all affected release lines.

Server-side request forgery in Hi.Events (all versions prior to 1.11.1-beta) allows an authenticated platform user to exfiltrate responses from internal network services, including cloud metadata endpoints, by exploiting a time-of-check/time-of-use gap in webhook URL validation. The registration-time guard in NoInternalUrlRule is never repeated at dispatch, and Guzzle's default redirect-following allows a destination that answers with a redirect to a loopback or RFC-1918 address to cause the server to issue the secondary request. Critically, this is not blind SSRF: WebhookResponseHandlerService stores the response body and WebhookLogResource exposes it via the webhook logs API, enabling direct credential or secret exfiltration. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Header injection via structured-mode CloudEvents in Apache Camel's Knative consumer enables unauthenticated SSRF, path traversal, and message-dispatch redirection against routes that forward to header-driven components. The flaw exists because CloudEvent extension fields in structured content mode (Content-Type: application/cloudevents+json) are copied directly into Camel Exchange headers without applying the KnativeHttpHeaderFilterStrategy that correctly guards the binary content-mode path - an incomplete fix of the same filter-bypass pattern addressed across multiple related CVEs (CVE-2025-27636, CVE-2025-29891, CVE-2025-30177, CVE-2026-40453, CVE-2026-47323). No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface - unauthenticated HTTP POST to a Knative endpoint - requires no special tooling.

SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated organization notification administrator to cause the AWX control node to issue outbound HTTP requests to internal, loopback, or RFC-1918 addresses that are not externally reachable. Beyond basic SSRF, the webhook backend compounds the risk by following HTTP redirects and replaying configured Basic Authentication credentials to the redirect destination regardless of host change, enabling credential exfiltration to attacker-controlled endpoints; the Grafana backend similarly exposes its API key by forwarding the Authorization header verbatim to any configured target URL. No public exploit has been identified at time of analysis, but the Changed scope and high confidentiality impact in the CVSS vector reflect significant real-world risk given the network position AWX control nodes typically occupy.

PDF export in RansomLook allows authenticated analysts to read arbitrary server-side files and conduct server-side request forgery by embedding crafted resource references in analysis documents. Prior to the patch, WeasyPrint's default URL fetcher resolved any scheme - including file:// and http:// - using the privileges and network access of the RansomLook server process, enabling exfiltration of local configuration and credentials or enumeration of internal network services. No public exploit code or CISA KEV listing exists at time of analysis; a fix is confirmed via GitHub commit 34dc0285583dae483b4d48c8e98fff942b755f5f, which introduces a strict URL allowlist restricting rendering to data: URIs, the report logo, and analysis asset files.

Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.12 allows low-privileged authenticated users holding the subscriber role to induce the WordPress server to make outbound HTTP requests to arbitrary internal or external destinations. The scope-changed CVSS vector (S:C) confirms the vulnerability can pivot beyond the WordPress application boundary to reach internal network services not otherwise exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not supplied.

Server-Side Request Forgery in the Shared Files WordPress plugin (versions up to and including 1.7.69) allows authenticated contributors to coerce the server into making arbitrary HTTP requests to internal or external resources. The CVSS vector (S:C) confirms a scope change, meaning the vulnerable WordPress instance becomes a proxy that can reach back-end infrastructure, internal APIs, or cloud metadata endpoints inaccessible to the attacker directly. No public exploit code or active exploitation has been identified at time of analysis, but contributor-level access in WordPress is a low bar - any registered site user with the Contributor role is sufficient.

Server-side request forgery in Hugo static site generator (versions 0.91.0 through 0.165.0) allows an attacker who can supply a URL through site content - via front-matter fields or a connected CMS - to silently fetch loopback, RFC 1918, or cloud-metadata endpoints during the build process, embedding the internal response directly into the published static output. The security.http.urls allowlist, Hugo's only guard on resources.GetRemote outbound fetches, evaluates hostname strings without performing DNS resolution, meaning any registered domain whose A record points to a private or metadata IP bypasses the policy entirely, and no dial-time hook in the HTTP client provides a second check. No public exploit code has been identified at time of analysis, but the attack requires only DNS control and content-write access, making it operationally straightforward in CI/CD-integrated deployments.

Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify ecosystem, allows remote unauthenticated attackers to redirect outbound requests from a target application to local or private IPv6 addresses by submitting crafted bracketed IPv6 literals with invalid trailing characters. The custom IPv6 parser silently normalizes malformed literals - collapsing some to the unspecified address (loopback) and others to private-range addresses - and returns no error on the parsed result, defeating any application-level error checking. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no special privileges and low complexity, making automated exploitation plausible against any exposed application that normalizes untrusted URLs through an affected fast-uri version.

Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.

Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Server-Side Request Forgery in BentoML versions 1.4.19 through 1.4.39 exposes internal CGNAT infrastructure by failing to block RFC 6598 shared address space (100.64.0.0/10) in the `make_safe_connect` safeguard. Unauthenticated remote attackers can supply crafted URLs via multipart file uploads or JSON request bodies, causing the BentoML server to make outbound requests to CGNAT-addressed internal hosts - a class of targets increasingly common in cloud-native and ISP environments. This is an incomplete fix for CVE-2025-54381; no public exploit has been identified at time of analysis, but the known patch gap and zero-prerequisite attack surface warrant prompt remediation.

Server-side request forgery in vas3k TaxHacker up to version 0.8.2 enables authenticated remote attackers to force the application server to initiate arbitrary IMAP TCP connections to attacker-controlled hosts and ports via the Email Sync configuration interface. The `buildImapConfig` function in `lib/email-sync/imap-client.ts` accepted unsanitized `host` and `port` parameters with no allowlist validation, no private-IP blocking, and no port restriction, allowing the TaxHacker server process to be redirected as a proxy into the internal network. No public exploit is identified at time of analysis; the upstream fix (PR #170) introduces a dedicated validation module but awaits merge acceptance and has not been released in a tagged version.

SSRF protection bypass in NLTK affects all versions before 3.10.0, where a fail-open logic error in validate_network_url() allows attackers to reach restricted network resources including cloud metadata endpoints such as 169.254.169.254. The flaw resides in _resolve_hostname(), which silently swallows OSError and ValueError from socket.getaddrinfo() and returns an empty list; the subsequent IP validation loop then iterates zero times, allowing urlopen() to execute the request with no filtering applied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the real-world impact is meaningfully elevated for cloud-deployed applications where metadata API access can expose IAM credentials.

Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and no CISA KEV listing.

Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. Vendor-released patches are available and no public exploit code has been identified at time of analysis.

Server-side request forgery in Microsoft's Azure SQL Database cloud service lets an unauthorized network attacker coerce the service into making backend requests that result in privilege elevation, with a maximum CVSS base score of 10.0 driven by a scope change (S:C). The CVSS vector (PR:N/UI:N) indicates no authentication or user interaction is required, and the CWE-918 classification confirms the root cause is unvalidated server-issued requests. No public exploit identified at time of analysis, and the flaw is not currently listed in CISA KEV.

Server-side request forgery in OpenViking before 0.3.4 allows authenticated low-privilege users to pivot the application server into an internal network proxy, reaching loopback addresses, RFC 1918 private ranges, link-local addresses, and cloud metadata endpoints such as AWS IMDS. By POSTing crafted URLs to /api/v1/resources, the attacker causes the server to issue outbound HEAD and GET requests with redirect-following enabled, then retrieves the responses through the normal content APIs - effectively mapping and interacting with internal services invisible from the public network. No public exploit identified at time of analysis; vendor-released patch in v0.3.4 is confirmed.

Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. A publicly available proof-of-concept exists; no CISA KEV listing confirms active exploitation at time of analysis.

Server-side request forgery in Headroom LLM proxy (versions before 0.36.1) allows unauthenticated remote attackers to redirect proxy upstream requests to arbitrary internal, loopback, link-local, or RFC 1918 destinations - including cloud instance metadata endpoints such as 169.254.169.254 - by supplying a crafted x-headroom-base-url request header. The proxy returns upstream responses verbatim to the caller, disclosing internal service content; critically, it also forwards the original Authorization header to the attacker-designated host, enabling credential harvesting. Exploitation is trivially achievable against deployments using the vendor-shipped docker-compose.yml, which binds 0.0.0.0 and enforces no HEADROOM_PROXY_TOKEN by default - a configuration weakness the server itself warns about at startup. No public exploit or KEV listing is identified at time of analysis; a vendor patch is available in v0.36.1.

Cross-tenant root command execution in Apache CloudStack (4.14.0.0-4.20.3.0 and 4.21.0.0-4.22.1.0) allows an authenticated tenant holding only the default User role to run arbitrary shell commands as root on the KVM hypervisor host, which also runs other tenants' VMs. The flaw stems from CloudStack fetching a user-supplied .metalink file during directDownload template registration and dispatching its inner URLs to the KVM agent without re-validating them against the scheme allowlist; a related SSRF variant lets the Secondary Storage VM retrieve internal targets and persist them as downloadable templates. No public exploit identified at time of analysis, and no CVSS is provided by the vendor.

Server-Side Request Forgery in Apache CloudStack's webhook module lets attackers coerce the management server into issuing arbitrary HTTP requests via webhook delivery, reaching internal-only services and cloud metadata endpoints that are otherwise unreachable from outside. It affects Apache CloudStack 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0, carries a CVSS 9.1 (high confidentiality and integrity impact), and has no public exploit identified at time of analysis. EPSS is low at 0.14% (4th percentile) and it is not on CISA KEV, indicating no observed active exploitation yet.

Pre-validation SSRF in Apache CloudStack's template and ISO registration allows authenticated users to trigger HTTP HEAD/GET requests to arbitrary URLs - including internal network resources - before URL validation is applied. Affected versions are 4.20.3.0 and 4.21.0.0 through 4.22.1.0; vendor-released patches exist in 4.20.3.1 and 4.22.1.1. No public exploit code or active exploitation has been identified at time of analysis, and exploitation requires valid CloudStack credentials with template-registration privileges.

Server-side request forgery in OpenStack Glance through 32.0.0 allows an authenticated administrator to bypass import_filtering_opts by submitting type=import tasks to the deprecated /v2/tasks API with an internal http:// or https:// URL, causing the Glance service to fetch internal network resources on the admin's behalf. The attack surface is substantially constrained by the PR:H requirement - valid OpenStack admin credentials must already be held - and the affected API has been deprecated for several releases. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Server-Side Request Forgery in PTC Windchill PDMLink and PTC FlexPLM allows unauthenticated remote attackers to induce the server to issue arbitrary internal network requests by submitting maliciously crafted serialized data for deserialization. The underlying root cause is CWE-502 (Deserialization of Untrusted Data), where the deserialization process itself is the vector that triggers the SSRF condition, enabling lateral movement toward backend infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of network accessibility and no authentication requirement elevates practical risk for internet-exposed deployments.

SSRF in langchain-community's SitemapLoader defeats the documented `restrict_to_same_domain` security control by failing to apply it to nested sitemap index entries, allowing an attacker who influences an ingested sitemap to exfiltrate responses from internal network resources including loopback, link-local, and RFC-1918 addresses. Any LangChain-based pipeline consuming attacker-influenced sitemaps is affected; the CVSS 4.0 score of 7.7 reflects high confidentiality impact on downstream internal systems (SC:H) with no authentication or complexity requirements. No public exploit code has been confirmed and the flaw is not listed in CISA KEV at time of analysis, though the attack path is directly derivable from the vulnerability description.

Server-Side Request Forgery in Lightdash's scheduled delivery webhook feature allows authenticated users to direct the backend server to issue POST requests to private, loopback, and link-local addresses - including cloud instance metadata endpoints. All deployments running versions prior to 1.146.4 are affected; both the Google Chat and Microsoft Teams webhook delivery paths bypass the existing validatePublicHttpUrl sanitization that is correctly applied elsewhere in the codebase. While the upstream response is never relayed to the attacker, the error-vs-success distinction enables internal network probing and, in cloud-hosted deployments, potential access to instance metadata services. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Server-side request forgery in Microsoft Copilot in Azure enables any authenticated Azure user to coerce the service into issuing arbitrary outbound requests, disclosing internal or cloud-infrastructure data back through the Copilot response channel. The CVSS scope-change indicator (S:C) and high confidentiality impact (C:H) suggest the service's privileged network position can be leveraged to reach resources beyond the application boundary - such as Azure Instance Metadata Service endpoints, internal APIs, or adjacent cloud services. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis; Microsoft has released a server-side patch.

Server-side request forgery in Microsoft Azure Virtual Machines enables a low-privileged authenticated attacker to forge internal network requests, ultimately achieving privilege escalation with full confidentiality, integrity, and availability impact across a changed scope. The CVSS vector (AV:N/AC:H/PR:L/S:C/C:H/I:H/A:H) confirms the vulnerability reaches beyond the Azure VM component itself, potentially compromising adjacent Azure services or internal metadata infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft has released a patch via MSRC.

Server-side request forgery in Microsoft Azure Data Factory exposes sensitive internal information to unauthenticated remote attackers over a network. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special network positioning - any internet-reachable instance is in scope. No active exploitation has been confirmed by CISA KEV or public POC at time of analysis; SSVC rates exploitation as 'none' and EPSS at 0.99%, indicating limited real-world uptake despite the high CVSS base score.

Server-Side Request Forgery in TREK, a collaborative travel planner, allows any authenticated user to pivot the server into making blind GET requests against loopback addresses, RFC 1918 internal networks, or cloud instance metadata endpoints (e.g., 169.254.169.254). The root cause is that importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() validate only the initial submitted URL via checkSsrf() but then call native fetch() with redirect:'follow', bypassing DNS-pinned safeFetch() on redirect hops. No public exploit code or CISA KEV entry has been identified at time of analysis; the CVSS 4.0 score of 5.3 reflects the authenticated prerequisite and blind (non-reflective) nature of the SSRF.