Server-Side Request Forgery

KubeSphere 4.1.3 and earlier ship a git credential verification endpoint that fetches caller-supplied URLs without any allowlist validation, letting an authenticated user point the server at internal services and capture the basic-auth credentials returned in the endpoint's error handling. The flaw is a classic CWE-918 SSRF that escalates into cross-namespace Secret disclosure because the leaked responses can expose credentials stored in any namespace. No public exploit code or CISA KEV entry has been identified at time of analysis, but the source-level references confirm the vulnerable code paths, and the CVSS 4.0 score of 8.3 reflects high confidentiality impact on both the vulnerable component and subsequent systems.

WeKnora's URL-based document ingestion endpoint (POST /api/v1/knowledge-bases/:id/knowledge/url) allows authenticated users to reach internal network resources and cloud metadata services by supplying a public URL that redirects to private addresses, bypassing the Go-side SSRF filter applied only to the initial submitted URL. Versions 0.5.2 through 0.6.x are affected; the Python/Playwright web scraper layer followed HTTP redirects without re-invoking SSRF validation, a gap the Go service handler did not share. No public exploit or CISA KEV listing exists at time of analysis, but the redirect-bypass technique is well-documented and accessible to any authenticated user.

XML External Entity injection in Flowable flowable-engine through 8.0.0 allows authenticated users holding process deployment privileges to exfiltrate arbitrary local files or perform server-side request forgery against internal network endpoints. The vulnerability resides in ProcessDiagramLayoutFactory.parseXml(), which processes user-supplied BPMN XML without disabling external entity resolution, and is present in both the main flowable-engine module and the legacy flowable5-engine (Activiti-derived) module. No public exploit code has been identified at time of analysis, and no confirmed patched release version is available from the referenced data.

Server-side request forgery and root-level code execution in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user smuggle arbitrary Python through submitted flow components. Because the component validation scanner fails to block socket and urllib imports yet still returns "validated": true, attackers run code as UID=0 to steal AWS credentials via IMDSv1 SSRF, exfiltrate container files, and pivot to internal PostgreSQL and Redis services. Public exploit code exists, though the flaw is not on the CISA KEV list.

An XML external entity (XXE) injection flaw in IBM MQ's reply-message processing lets an authenticated attacker who can place messages on a queue cause the broker to resolve externally defined entities, resulting in arbitrary file disclosure from the MQ server and server-side request forgery against internal networks. The issue spans a wide swath of supported releases - MQ 9.1 LTS through 9.1.0.37, 9.2 LTS through 9.2.0.43, 9.3 LTS through 9.3.0.41 and 9.3 CD through 9.3.5.1, 9.4 LTS through 9.4.0.25 and 9.4 CD through 9.4.5.1, plus MQ 10.0.0.0 Managed File Transfer. IBM rates it CVSS 7.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality, low integrity impact); no public exploit code and no CISA KEV entry were identified at time of analysis.

Server-Side Request Forgery in PraisonAI's multi-agent web tooling allows an authenticated user to exfiltrate internal service responses by supplying a hostname whose DNS A record resolves to a loopback, RFC-1918, link-local, or cloud-metadata address. The SSRF guard in `SpiderTools._validate_url` → `_host_is_blocked` inspects only literal IP encodings and silently falls through for any DNS hostname, meaning a static internal A record is sufficient - no DNS rebinding race is required. Affected are praisonaiagents versions up to 1.6.48 (per GHSA) across the `scrape_page`, `crawl`, `extract_links`, `extract_text`, and `@url` mention-fetch surfaces; the fix ships in praisonaiagents 1.6.58/1.6.59 and PraisonAI 4.6.58. No public exploit identified at time of analysis, though SSVC notes a proof-of-concept exists.

Server-side request forgery in Open Notebook before 1.11.0 allows authenticated users to pivot through the application server to reach cloud instance metadata services, internal network hosts, and localhost-bound services by supplying arbitrary URLs to the POST /api/sources endpoint. The vulnerable parameter is passed directly to the server's HTTP client without any allowlist or blocklist validation, making the application a proxy for internal reconnaissance. No public exploit code has been identified at time of analysis, but the impact is high given the cloud metadata access path (e.g., AWS IMDSv1 credential theft).

SSRF fix bypass in FrontMCP v1.2.1 and its dependency mcp-from-openapi 2.3.0 allows authenticated users of hosted deployments to reach internal network services by supplying crafted OpenAPI specs containing external `$ref` URLs. The previous patch for CVE-2026-39885 introduced a hostname-string denylist that is circumvented via DNS names resolving to loopback (e.g., 127.0.0.1.nip.io), HTTP redirect chains to loopback after an initially allowed host, and IPv4-mapped IPv6 syntax (::ffff:127.0.0.1). A working proof-of-concept with five confirmed bypass vectors is included in the advisory; no CISA KEV listing exists at time of analysis.

Server-Side Request Forgery in Shelf (shelf.nu) asset-tracking platform before v1.20.3 allows authenticated users holding the `asset:import` permission to force the application server to make unrestricted outbound HTTP requests by supplying crafted `imageUrl` values inside a CSV import file. Multiple documented bypass techniques - including image-extension suffixes, redirect chains, and domain substring matching - allow the weak URL validation to be circumvented, after which the server executes an unguarded `fetch()` call. Attackers can reach cloud instance metadata endpoints (e.g., AWS IMDS) to steal IAM credentials, probe internal network services, or trigger memory exhaustion by causing the server to buffer arbitrarily large responses before size checks apply. Vendor-released patch v1.20.3 addresses the issue; no public exploit code identified at time of analysis.

Server-Side Request Forgery in Google Cloud Gemini Enterprise Agent Platform App Builder (all versions prior to the 2026-06-01 deployment date) enables unauthenticated remote attackers to exfiltrate the Compute Engine default service account access token by forcing the application to issue requests to the GCP instance metadata service. The stolen OAuth 2.0 bearer token carries the IAM permissions of the default service account, potentially enabling lateral movement across GCP project resources. Vendor-released patch was deployed on 1 June 2026, but existing app deployments require a manual redeployment to receive the fix - creating remediation lag risk for unmanaged deployments.

Server-Side Request Forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant - regardless of project membership or assigned role - to weaponize the shared ds-canvas pod as a network proxy by fully controlling the scheme, host, port, and path of outbound WSDL fetches it performs. The pod's position on the OpenShift overlay network grants reach to co-tenant services, in-cluster CP4D APIs, and link-local IMDS-style addresses, and the fetched body is reflected verbatim to the caller, enabling cross-tenant data exfiltration and internal service reconnaissance. No public exploit or KEV listing has been identified at time of analysis; vendor patch is available.

Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 allows unauthenticated remote attackers to coerce the application server into fetching arbitrary internal network resources by supplying malicious URLs to the platform's URL-processing functionality. The scope-changed CVSS vector (S:C/C:H) reflects that exploitation exposes systems beyond Langflow itself - including cloud metadata services, internal APIs, and private network hosts accessible from the Langflow host. No public exploit has been identified at time of analysis; a vendor patch is available via IBM's support portal.

Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.5 allows unauthenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP requests, exposing internal network services, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and other resources inaccessible to the attacker directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) confirms this requires no authentication and trivial network access, with high confidentiality impact. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Remote code execution is achievable in IBM DataStage on Cloud Pak for Data 5.4.0.0 through a Server-Side Request Forgery vulnerability that enables an authenticated low-privilege attacker to cause the DataStage server to issue crafted requests to internal resources, ultimately resulting in full host compromise. The CVSS 8.8 score (PR:L) confirms that standard user-level credentials are sufficient to trigger the attack, with no user interaction required and full confidentiality, integrity, and availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via the IBM advisory.

Server-Side Rendering in Angular's @angular/platform-server leaks server-side credentials to attacker-controlled origins via a Unicode whitespace URL validation bypass. When application code validates a user-supplied URL using WHATWG URL parsing (correctly rejecting protocol-relative paths), Angular's internal `resolveUrl` and `parseUrl` utilities subsequently call `String.prototype.trim()`, which strips leading Unicode characters such as U+00A0 (non-breaking space) or U+FEFF (BOM) that WHATWG parsing does not remove - transforming an apparently safe relative path into a protocol-relative URL pointing to the attacker's server. Applications using `relativeUrlsTransformerInterceptorFn` that attach Authorization or other credential headers to outbound HttpClient requests then dispatch those requests - including credentials - to the attacker's origin, resulting in SSRF and credential disclosure. No public exploit has been independently identified at time of analysis, though the patch commits effectively document the bypass technique.

SSRF in AWS Systems Manager Agent's port-forwarding feature allows an authenticated remote user to bypass the link-local address denylist and reach the EC2 Instance Metadata Service (IMDS), enabling theft of the managed instance's temporary IAM role credentials. The bypass exploits insufficient canonicalization of IP addresses before denylist evaluation - alternate representations of 169.254.169.254 (hex, decimal, IPv6-mapped, etc.) pass the check unblocked. With stolen credentials, the attacker can exercise the instance's full IAM role permissions from outside the instance. No public exploit identified at time of analysis, but the release notes confirm the fix explicitly canonicalizes IPs and extends the denylist to include ECS/EKS credential endpoints.

Unauthenticated server-side request forgery in GeoNetwork's SLD tools endpoint (POST /api/tools/ogc/sld) allows any anonymous attacker to pivot through the server into its internal network, issuing arbitrary outbound HTTP GET requests to hosts that would otherwise be unreachable from the internet. Affected Maven artifact gn-web-app spans versions 4.0.0-4.2.16 and 4.4.0-4.4.11; vendor-released patches exist at 4.2.17 and 4.4.12. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the vulnerability is trivially exploitable against default, publicly facing deployments.

Server-side request forgery in Open WebUI prior to 0.11.1 allows authenticated users to reach internal cloud infrastructure by exploiting gaps in Python's `is_global` address classification. The web retrieval endpoints POST /api/v1/retrieval/process/web and /process/web/search relied solely on Python's built-in global-address check, which does not reject the Azure platform channel IP (168.63.129.16) or other reserved ranges such as multicast, 6to4 relay, NAT64, IPv6 site-local, and embedded-IPv4 representations. On Azure-hosted deployments this enables exfiltration of platform metadata, certificates, and management tokens accessible via the wire-link channel. No public exploit identified at time of analysis; vendor-released patch exists as version 0.11.1.

Server-Side Request Forgery in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) versions 9.1.2 and prior enables a privileged authenticated attacker to send crafted, unvalidated parameters to a server endpoint, causing the platform to make unauthorized outbound or internal requests. The resulting impact spans unauthorized command execution and disclosure of server-side data - a unusually severe outcome for SSRF, likely achieved by pivoting through the SSRF to reach privileged internal services. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Server-side request forgery in Snipe-IT before 8.7.0 allows an authenticated low-privileged attacker to pivot the application server against internal network resources, cloud metadata endpoints, or arbitrary external targets. The vulnerability stems from TCPDF's writeHTML() processing unsanitized img tag injection through the employee_num field in the asset acceptance PDF generator. Exploitation is deferred until a victim user signs an asset acceptance form, at which point the server makes an outbound HTTP(S) request to the attacker-controlled URL embedded in the rendered PDF. A proof-of-concept exists per SSVC data; no active exploitation has been confirmed in CISA KEV.

Arbitrary file read and SSRF in Snipe-IT before 8.7.0 allow low-privileged users to exfiltrate sensitive server files - including .env credential files - via unsanitized EULA text fields. An attacker with category-edit permissions injects markdown image syntax or raw HTML img tags referencing local file paths or remote URLs; the mail auto-embed library resolves these references server-side during checkout confirmation email generation and returns the resolved content as email attachments. No public exploit has been identified at time of analysis, and a vendor patch is available at 8.7.0.

Server-side request forgery in Lara Dashboard 0.9.2-1.3.1 allows any authenticated content editor to proxy arbitrary HTTP requests through the application server via the markdown fetch API endpoint, with the server returning response bodies verbatim to the caller. The POST /api/admin/builder/markdown/fetch endpoint validated only URL format (not destination host), enabling requests to internal services and cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254, which can yield IAM role temporary credentials. No public exploit identified at time of analysis; vendor-released patch is available in v1.3.2.

Server-Side Request Forgery (SSRF) in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to coerce the appliance or application into issuing arbitrary HTTP/HTTPS requests to internal or external destinations, leading to unauthorized access to internal network services, cloud metadata endpoints, or other back-end resources not intended for external exposure. Both the Appliance and Application deployment modes are affected across all versions prior to the fixed releases. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforwardly exploitable against any internet- or intranet-accessible instance.

Server-Side Request Forgery in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers to cause denial of service against both the Application and Appliance (Virtual Edition) deployment forms. The CVSS vector confirms fully unauthenticated network exploitation with no user interaction, targeting availability exclusively - confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified; EPSS places this in the 8th percentile, and the CISA SSVC assessment lists exploitation status as none.

Server-side request forgery in Tanium Enforce allows authenticated low-privileged users to cause the Enforce server to issue arbitrary HTTP requests to internal network resources outside the application's normal authorization boundary. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect that a successful attack can expose internal services, cloud metadata endpoints, or backend infrastructure inaccessible to the attacker directly. Tanium disclosed and addressed this issue in advisory TAN-2026-036; no public exploit code or active exploitation has been identified at time of analysis.

We need answer JSON only. Need synthesize. Need be careful precision. Let's parse input. CVE-2026-87595 description: SSRF in Mobile in Google Chrome prior to 153.0.8010.36 allowed remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H given. CWE-918. EPSS 0.18% percentile 7%. Patch available from vendor. Tags Google, SSRF. CPE google chrome. Affected versions EUVD: ["Chrome 153.0.8010.36 <153.0.8010.36"] weird, maybe means prior to 153.0.8010.36. References. Need output fields. product_name: Google Chrome. summary: original synthesis not copy. Mention SSRF in Chrome Mobile prior 153.0.8010.36, remote attacker leveraging social engineering bypass access restrictions via crafted HTML. Chromium severity low despite CVSS 9.8. EPSS low, no KEV, no POC. Need say no public exploit identified. "confirmed actively exploited"? no KEV absent. POC absent. Use phrase "no public exploit identified at time of analysis". Could say "Although CVSS score is 9.8, Chromium rates severity Low; EPSS is 0.18%". Need uncertainty: CVSS vector conflict with description: AV:N PR:N UI:N vs description says social engineering = user interaction likely. We need state this explicitly in risk and confidence. CVSS says UI:N and high impact, but description says leveraging social engineering and Chromium severity low. Maybe SSRF impact could be high? But likely CVSS is incorrect? We can use own assessed vector maybe UI:R due social engineering, maybe AC:L? Let's determine assessed CVSS. Vulnerability: SSRF in Mobile in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering via crafted HTML page to bypass system access restrictions. SSRF means server-side request forgery in Chrome Mobile? The browser is client? "Mobile" component. Attack vector network? User interaction required because social engineering to visit crafted HTML page. So AV:N AC:L PR:N UI:R

Credential exfiltration in n8n's OpenAI Chat Model node allows an authenticated workflow editor to redirect the model-search dropdown request - including the attached OpenAI API key - to an arbitrary attacker-controlled host by overriding `options.baseURL`. Affected versions span the v1 branch prior to 1.123.76 and the v2 branch prior to 2.37.7 and 2.38.2; the root cause is the omission of `assertOpenAiCredentialAllowsUrl` in `loadModels.ts`, the same domain-restriction guard applied elsewhere in the node. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches are available across all three branches.

Server-side request forgery in Apache Impala 4.4.x and 4.5.x allows authenticated users with execute permission on the `ai_generate_text()` function to exfiltrate secrets stored in Hadoop Credential Providers configured via `hadoop.security.credential.provider.path` in `core-site.xml`. The attacker must know the alias (key name) of the target secret, limiting opportunistic exploitation; however, successful exfiltration yields plaintext credentials that can be leveraged for downstream compromise of connected systems. No public exploit code has been identified and EPSS sits at 0.20% (10th percentile), indicating low observed exploitation pressure.

Server-side request forgery in Microsoft Skype for Business Server exposes internal network resources to unauthenticated remote attackers. Three server product lines are affected - Subscription Edition, 2015 (CU13), and 2019 (CU8) - all running builds below their respective patched versions. An attacker with network access to the server can forge requests through the server to enumerate or exfiltrate data from internal systems, with no public exploit identified at time of analysis.

Server-side request forgery in Visual Studio Code prior to 1.136.2 allows a remote unauthenticated attacker to bypass security features and force VS Code to issue HTTP requests to internal or otherwise restricted network resources on the victim's behalf. Exploitation requires user interaction - a developer must open or trigger attacker-controlled content within VS Code - after which the editor acts as a request proxy, crossing trust boundaries (S:C) to reach endpoints inaccessible from the attacker's network position. No public exploit code or active CISA KEV listing has been identified at time of analysis; however, developers are high-value targets due to their typical privileged network access to internal infrastructure.

Server-side request forgery in Microsoft SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to coerce the server into issuing arbitrary HTTP requests to internal or adjacent network resources, resulting in high-impact information disclosure. The CVSS scope-change flag (S:C) confirms that exploitation can expose resources beyond the SharePoint application boundary - including internal APIs, metadata services, or intranet hosts - making this a meaningful lateral-movement enabler despite its read-only impact. No public exploit code has been identified at time of analysis, and EPSS at 0.86% (56th percentile) suggests limited opportunistic exploitation so far.

Server-Side Request Forgery in XenForo's PayPal REST webhook handler enables unauthenticated remote attackers to coerce the application server into making arbitrary outbound HTTP requests by supplying a crafted certificate URL in webhook request headers. All XenForo versions prior to 2.3.13 are affected due to the absence of scheme, hostname, or allowlist validation on the attacker-controlled URL. The primary exploitation path targets cloud-hosted deployments: the server can be directed to reach the AWS, GCP, or Azure instance metadata service (169.254.169.254), potentially exfiltrating IAM role credentials and enabling lateral movement into cloud infrastructure. No public exploit has been identified at time of analysis, but the attack surface - an unauthenticated POST to a publicly reachable webhook endpoint - makes this highly automatable against cloud-hosted XenForo instances.

Server-Side Request Forgery in the Hide My WP Ghost WordPress plugin (all versions through 7.0.09) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external hosts. Reported by Patchstack under EUVD-2026-72652, the vulnerability carries a CVSS 7.2 with scope change (S:C), meaning successful exploitation can affect infrastructure beyond the WordPress host itself - including cloud metadata endpoints or internal network services. No public exploit code or active exploitation has been identified at time of analysis.

Server-side request forgery in MISP ≤2.5.45 allows high-privileged users who configure threat intelligence feeds or TAXII discovery endpoints to cause MISP to make outbound HTTP requests to internal network resources and to exfiltrate configured feed authentication credentials to attacker-controlled hosts via unsanitized redirect following. A secondary incomplete SSRF defense in the TAXII discovery path failed to block IPv6 loopback (::1), hex-encoded addresses (0x7f000001), and multi-record DNS responses because it relied on gethostbyname() against a short literal blocklist. No public exploit code or active exploitation (CISA KEV) has been identified; patch commits are available upstream.

Server-side request forgery in OpenMAIC before 1.0.1 lets unauthenticated attackers coerce the server into fetching arbitrary attacker-supplied provider URLs, reaching cloud instance metadata endpoints (e.g. 169.254.169.254) to steal IAM credentials and instance metadata. The flaw exists because the outbound URL guard was gated to production builds only, so any deployment not running under NODE_ENV=production skipped SSRF validation entirely. Reported privately by VulnCheck; a vendor patch (v1.0.1) is available, no public exploit code was identified, and the product is not in CISA KEV.

Bifrost HTTP transport before version 2.0.0 exposes an unauthenticated plugin installation endpoint (POST /api/plugins) that accepts HTTP URLs as plugin paths, enabling SSRF on all build types and unauthenticated remote code execution on dynamically linked builds. Because management authentication is disabled by default (governance.auth_config.is_enabled=false), no credentials are required to trigger the flaw; the shared-object loader fetches the attacker-supplied URL, writes it as a temporary .so, and on DYNAMIC=1 builds calls plugin.Open() which immediately executes the plugin's Init() function as the Bifrost process user. Reported by JFrog, the fix ships in transports/v2.0.0, adding an SSRF-safe dial context (SSRFSafeDialContextWithAllowlist) around plugin downloads; no public exploit code or active exploitation has been confirmed at time of analysis.

Unauthenticated server-side request forgery in MindsDB through 26.1.0 allows remote attackers to coerce the platform's web crawler handler into fetching arbitrary attacker-supplied URLs. The root cause is a default-empty allowlist in CrawlerTable.list (web_handler.py lines 50-65), meaning MindsDB ships with no URL restrictions enforced, enabling direct access to internal network services and cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). No public exploit has been confirmed at time of analysis, but VulnCheck published a detailed advisory with precise source-code references, lowering the bar to exploitation significantly.

Server-side request forgery in SQL Chat (the open-source sqlchat AI database client) lets remote unauthenticated attackers abuse four API endpoints (including /api/connection/execute and /api/connection/test) that accept client-supplied database connection parameters and run arbitrary SQL against any attacker-named host. Because no authentication is enforced, an attacker can point the server at internal databases, enumerate schemas, execute queries, and pivot through the SQL Chat host into otherwise unreachable network segments. No public exploit identified at time of analysis, though the affected source files and a VulnCheck advisory pinpoint the exact vulnerable code.

Server-side request forgery in Webstudio through 0.296.0 lets unauthenticated remote attackers abuse the /cgi/image, /cgi/video, and /cgi/asset proxy routes to fetch attacker-chosen URLs whenever the RESIZE_ORIGIN environment variable is unset. Because the proxy blindly forwards supplied URLs, an attacker can read cloud instance metadata (e.g. IMDS credentials), reach internal-only services, and map the instance's private network. Reported by VulnCheck with a public advisory; no public exploit code or CISA KEV listing is present at time of analysis.

Server-side request forgery in nebula-mesh 0.6.0-0.7.1 lets any low-privilege 'user'-role operator coerce the control plane into making HTTP requests to internal, loopback, and link-local addresses by setting allow_private: true on their own webhook subscription. The missing authorization check in both the create and update webhook handlers (internal/api/webhooks.go) means the SSRF guard that protects all other tenants is silently bypassed at delivery time, exposing cloud metadata endpoints, internal APIs, or backend services reachable only from the server. A working proof-of-concept has been verified against a live instance; vendor-released patch v0.7.2 is available.

Sensitive information disclosure in IBM ContextForge MCP Gateway (mcp-contextforge-gateway) v1.0.6 and earlier enables remote authenticated attackers to reach internal network resources via a DNS rebinding attack during tool invocation. The vulnerability is classified as CWE-918 (SSRF), with the DNS rebinding mechanism serving as a bypass to route gateway-initiated requests to otherwise-unreachable internal hosts. The CVSS Scope:Changed metric confirms that the impact extends beyond the gateway itself to downstream internal services, resulting in high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.

Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.2 enables authenticated remote attackers to exploit a URL parser discrepancy, causing the application to issue unauthorized backend requests to internal services and expose sensitive information beyond the application's trust boundary. The CVSS scope-change metric (S:C) confirms that impact extends past the Langflow instance itself to internal network resources not directly reachable by the attacker. Vendor patch is available via IBM's support portal; no public exploit code or active exploitation has been identified at time of analysis.

Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows unauthenticated remote attackers to induce the server to issue HTTP requests to attacker-controlled destinations, enabling exfiltration of sensitive information from internal network resources, cloud metadata endpoints, or the application's own environment. The CVSS vector (PR:N/AV:N/AC:L) indicates this is exploitable without authentication at low complexity, which is notable for an AI workflow platform likely deployed with access to cloud infrastructure credentials. No public exploit code or active exploitation has been identified at time of analysis, though the automatable SSVC signal and high confidentiality impact make this a meaningful exposure in cloud-hosted or hybrid deployments.

Server-side request forgery via DNS rebinding in IBM ContextForge MCP Gateway allows a remote low-privileged attacker to pivot through the gateway into otherwise network-isolated internal resources, yielding high confidentiality impact and potential integrity impact against back-end services. The CVSS scope-change flag (S:C) reflects that a successful exploit extends the attack beyond the gateway itself to internal infrastructure it services. No public exploit code has been identified at time of analysis; a vendor patch is available via IBM's support advisory.

Server-side request forgery in jina-ai reader allows unauthenticated remote attackers to probe internal network infrastructure and cloud metadata services by exploiting a redirect-validation gap in the URL fetching pipeline. The service validates URLs on initial submission but fails to re-validate the destination after HTTP redirects, enabling attackers to pivot from an attacker-controlled public URL to cloud instance metadata endpoints (e.g., AWS IMDS at 169.254.169.254) or RFC-1918 internal addresses, with the response body returned to the attacker. No public exploit code has been independently confirmed at time of analysis, though a VulnCheck advisory and a public GitHub issue (jina-ai/reader#1252) detail the flaw.

Server-side request forgery and model spoofing in lm-sys FastChat let unauthenticated remote attackers register arbitrary workers via the controller's /register_worker endpoint, which performs no authentication. By registering a malicious worker address under a legitimate model's name, an attacker can silently intercept user prompts, uploaded images, and model responses, or coerce the controller into probing internal network ports across the worker mesh. No public exploit identified at time of analysis; the issue was reported by VulnCheck and CVSS 4.0 is scored 9.3.

Server-side request forgery in Nightingale (n9e), the open-source observability platform by ccfos, allows authenticated users of the http_fetch AI-agent tool to bypass the platform's SSRF guard by encoding forbidden IPv4 addresses using 6to4, NAT64, or deprecated site-local IPv6 representations. The isPublicIP function in aiagent/tools/http.go only unwraps standard ::ffff:a.b.c.d IPv4-mapped IPv6 addresses before applying the forbidden-range check, leaving 2002::/16 (6to4), 64:ff9b::/96 and 64:ff9b:1::/48 (NAT64), and fec0::/10 (site-local) unrecognized and passable as 'public'. On dual-stack or NAT64-enabled cloud hosts, this allows an attacker to reach the cloud instance-metadata endpoint (169.254.169.254) or internal services and exfiltrate IAM credentials or sensitive configuration. No public exploit code has been identified at time of analysis.

Unauthenticated SSRF in MegaParse 0.0.55 allows any remote attacker to make the server issue arbitrary HTTP requests by supplying attacker-controlled URLs to the POST /v1/url endpoint, with full responses returned in the JSON reply. Because no authentication is required and the endpoint fetches URLs server-side without restriction, attackers can pivot to cloud provider metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and other non-routable services that are reachable from the MegaParse host. No public exploit or CISA KEV listing has been identified at time of analysis, though the attack surface is trivially exploitable against any internet-exposed deployment.

Server-side request forgery in ms-swift 4.5.2 allows unauthenticated remote attackers to weaponize the server's multimodal media fetching logic against internal infrastructure. The OpenAI-compatible deploy API accepts image_url, audio_url, and video_url parameters that are passed to vision_utils.py without URL validation or redirect filtering, enabling arbitrary outbound requests to cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and network-adjacent services. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network-accessible attack surface and high confidentiality impact make this a significant risk for any internet-exposed ms-swift deployment.

Server-side request forgery in camel-ai OWL's DocumentProcessingToolkit exposes internal network resources to unauthenticated remote attackers across all tracked versions. The `extract_document_content` tool fetches caller-supplied URLs with no scheme, host, or IP allowlist, enabling attackers to pivot through the agent server to reach cloud metadata endpoints, internal APIs, or other SSRF-reachable services. The attack is delivered via prompt injection - malicious URL directives embedded in content processed by the OWL agent - with SSRF responses surfaced directly in the agent's context window, potentially leaking credentials or internal topology. No public exploit code or CISA KEV listing has been identified at time of analysis.

SSRF guard bypass in LLaMA-Factory's OpenAI-compatible API multimodal media URL handler exposes internal network services and cloud metadata endpoints to unauthenticated remote attackers. The vulnerability stems from a TOCTOU (time-of-check/time-of-use) race in the check_ssrf_url guard: the URL is validated once, but the subsequent requests.get call follows HTTP redirects and re-resolves DNS without re-validation, defeating the protection. Attackers can exploit this via HTTP redirect chains or DNS rebinding to force the API server to fetch resources from RFC1918 addresses or cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), potentially exfiltrating IAM credentials. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.

Unauthenticated message injection and server-side request forgery in TeamWiseFlow xiaobei through 5.5.2 let remote attackers reach the agent pipeline without any credentials. The webhook endpoints implement neither authentication nor signature validation (CWE-306), so an attacker can POST crafted payloads to the /webhook_worktool handler to inject arbitrary messages, and abuse the handler's unvalidated media-URL fetching to make the server issue requests to internal services. No public exploit identified at time of analysis, but the flaw is remotely reachable against default deployments and was independently reported by VulnCheck.

Server-side request forgery in OGX's (formerly Llama Stack) OpenAI-compatible POST /v1/responses endpoint allows remote unauthenticated attackers to force the server to open connections to arbitrary internal addresses, including cloud instance metadata services at 169.254.169.254, and relay attacker-controlled headers and bearer tokens to those destinations. MCP tool definitions accept a server_url parameter that is fetched server-side without applying the existing validate_url_not_private() guard that protects other URL inputs. On OGX's default starter configuration - which runs without any authentication - exploitation requires only a crafted HTTP request, exposing cloud credentials and internal network topology to any remote attacker. No public exploit has been identified at time of analysis.

Server-side request forgery in Douyin_TikTok_Download_API through version 4.1.2 exposes internal network resources and cloud instance credentials to unauthenticated remote attackers. The /api/download and /api/hybrid/video_data endpoints accept a user-supplied url query parameter without validation, allowing any caller to instruct the server to fetch arbitrary URLs - including cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254) - and read back full response bodies or error messages containing sensitive credentials. No vendor-released patch has been identified at time of analysis, and the GitHub issue tracker confirms the disclosure is public.

Server-side request forgery in OpenPanel before 2.3.0 lets unauthenticated remote attackers coerce the panel server into issuing arbitrary outbound requests via the GET /tools/site-checker endpoint, which accepts a fully client-controlled URL with no private-IP filtering or DNS-rebinding defenses. Attackers can reach localhost, internal-only services, and cloud metadata endpoints, harvesting HTTP response titles, headers, status codes, and SSL certificate details. Reported by VulnCheck with a fix in 2.3.0; no public exploit identified at time of analysis, though the endpoint is trivially reachable.

Unauthenticated SSRF in OpenPanel before 2.3.0 exposes two utility endpoints - /misc/favicon and /misc/og - that blindly fetch attacker-supplied URLs without adequate validation. Any remote, unauthenticated attacker can direct the OpenPanel server to query internal network hosts or cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), with response bodies returned verbatim to the attacker, enabling direct theft of cloud IAM credentials and systematic enumeration of internal services. The vendor has released a fix in version 2.3.0 per the GitHub Security Advisory GHSA-2hff-m67f-2w2w; no public exploit code or CISA KEV listing is identified at time of analysis.

Unauthenticated remote root compromise of ASUS Control Center (Enterprise/ACC) is possible by chaining a missing-authentication flaw, an SSRF, and hard-coded credentials: an attacker retrieves the product's encryption key over a plain HTTP request, which causes a local service to enable SSH on port 2222, then logs in with built-in credentials to gain a root shell. From that shell an attacker can read, write, and delete all ACC data and remotely control every managed server, PC, and workstation in the environment. ASUS assigns CVSS 4.0 base 10.0; no public exploit identified at time of analysis.

Privilege elevation in Microsoft Power Automate (Power Platform cloud service) lets an authenticated, low-privileged attacker abuse a server-side request forgery flaw (CWE-918) to make the service issue requests to internal/backend endpoints, resulting in a scope-changing escalation with total confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 9.9 with a changed scope, reflecting that the SSRF crosses a trust boundary into resources beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.33%, 26th percentile), consistent with CISA SSVC marking exploitation as 'none'.

Server-Side Request Forgery in Apache Allura through version 1.20.0 lets attackers abuse the project webhook feature to coerce the server into issuing arbitrary outbound requests, enabling access to internal-only services and cloud metadata endpoints. The flaw is fixed in 1.21.0. No public exploit is identified at time of analysis and EPSS is low (0.21%, 11th percentile), indicating no observed mass-exploitation pressure despite the high CVSS.

Unauthenticated SSRF in the LiteSpeed Cache WordPress plugin (versions ≤ 7.9) allows any remote attacker without credentials to induce the WordPress server to issue arbitrary HTTP requests to internal or external endpoints. Reported by Patchstack under CWE-918, this flaw can expose internal infrastructure, cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), and backend services not otherwise reachable from the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's massive deployment footprint makes this a meaningful exposure for any internet-facing WordPress installation.

Server-side request forgery in OpenStack Glance 16.0.0 through 32.0.0 allows authenticated tenant users to make the image service fetch arbitrary internal URLs, including cloud metadata endpoints at 169.254.169.254, turning the image import pipeline into a full-read SSRF channel. Three related flaws (CVE-2026-71196, CVE-2026-71197, CVE-2026-71198) stem from insecure default host filtering in the web-download import method, a DNS rebinding bypass that evades the validator, and absent host filtering in the HTTP image location API respectively. Because Glance stores fetched bytes as downloadable image data, none of these are blind SSRF - the full response body is directly retrievable by the attacker. No public exploit has been identified, but the cloud-credential-theft impact warrants urgent remediation in any multi-tenant or internet-facing OpenStack deployment.

DNS rebinding bypass in OpenStack Glance's web-download URI validator allows authenticated tenant users to circumvent host-filter restrictions and force the image service to fetch arbitrary internal URLs, enabling full-read SSRF exfiltration via the image download API. The validator evaluates host filters against the raw pre-resolution hostname, creating a TOCTOU window: an attacker's domain passes the check resolving to a legitimate external IP, then DNS rebinding redirects the actual fetch to internal targets such as the cloud instance metadata service at 169.254.169.254. Glance versions 16.0.0 through 30.2.0, 31.0.0 through 31.1.0, and 32.0.0 are affected; no public exploit has been identified at time of analysis.

Server-side request forgery in OpenStack Glance before 32.0.1 allows authenticated cloud tenants to probe internal network endpoints by registering HTTP image locations that bypass host-restriction filtering. The location API - both POST /v2/images/{id}/locations and the PATCH API when show_multiple_locations is enabled - validates only the URL scheme and ignores the import_filtering_opts host allow-list that guards the web-download path, permitting requests to addresses such as the cloud metadata service at 169.254.169.254. A low-privileged tenant can then retrieve the server's response by downloading the image, potentially exposing ephemeral instance credentials or bootstrap secrets. No public exploit code has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.0 with SC:H reflects genuine cross-boundary credential exposure risk on affected deployments.

Server-Side Request Forgery in Ollama versions 0.30.0 through 0.33.2 allows unauthenticated remote attackers to redirect the Ollama server's blob-download requests to arbitrary internal hosts, including cloud metadata endpoints such as the AWS instance metadata service. The flaw exists in the tensor-layer model pulling code path (x/transfer/download.go), where HTTP redirect destinations are not validated against an allowlist or the originating registry host. With no public exploit identified at time of analysis, the primary real-world impact is credential theft from cloud metadata services when Ollama runs on cloud-hosted infrastructure.

Server-side request forgery in Label Studio through 1.23.0 allows authenticated users to route outbound webhook requests to RFC 1918 private addresses and cloud instance metadata endpoints (e.g., 169.254.169.254), bypassing network segmentation controls. By creating a webhook that targets an internal service and enabling payload transmission, an attacker can probe internal infrastructure topology and exfiltrate annotation data to attacker-controlled destinations in the same operation. No public exploit exists at time of analysis, but the patch commit confirms the affected code path in label_studio/webhooks/utils.py and the fix extends SSRF controls to S3 endpoint validation as well.

Local file read and server-side request forgery (SSRF) in n8n's Gmail (v1) and Brevo workflow nodes allow an authenticated low-privilege user to exfiltrate files accessible to the n8n process or probe internal network endpoints by supplying a crafted expression that resolves to a JavaScript object with a `path` or `href` property. Affected versions span the stable branch before 1.123.73 and the 2.x branch before 2.35.4 and 2.36.2, as confirmed by vendor advisory GHSA-95ph-833c-4wrp. No public exploit has been identified at time of analysis, but the attack mechanism is well-defined and low-complexity for any user with workflow creation rights.

Server-side request forgery in WWBN AVideo (all versions through commit c91b5975d) allows authenticated API clients to force the application server to fetch arbitrary internal URLs via the unvalidated `profileImg` and `backgroundImg` parameters in the `set_api_userImages` endpoint. Unlike blind SSRF, fetched responses are written to publicly accessible web paths, enabling reliable exfiltration of cloud metadata credentials (e.g., AWS IMDS IAM tokens), internal API responses, and network-internal service data. No public exploit code or CISA KEV listing exists at time of analysis, but the non-blind exfiltration path significantly elevates real-world exploitability for cloud-hosted deployments.

Server-side request forgery in AVideo's EPG parser allows authenticated uploaders to force the server to fetch arbitrary internal URLs via the epg_link parameter during video upload. Any AVideo instance through commit c91b5975d is affected; the parameter undergoes only syntactic validation at submission time, and the actual server-side HTTP fetch during EPG generation occurs without SSRF protections such as private-IP blocking, allowlisting, or DNS rebinding defenses. No public exploit has been identified at time of analysis, but the attack requires only uploader-level credentials and is straightforward to execute against cloud-hosted or internally-networked deployments.

SSRF in OCSreports (OCS Inventory NG) allows authenticated operators to weaponize the inventory server as a proxy to reach internal network services or cloud metadata endpoints via the /ocsreports/?function=tele_activate endpoint. By supplying attacker-controlled values for the HTTPS_SERV and FILE_SERV parameters, an operator-level account can cause the server to issue outbound HTTP/HTTPS requests to otherwise-inaccessible destinations, including cloud provider metadata APIs such as AWS IMDSv1. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by INCIBE as part of a multi-flaw advisory.

Host-parsing ambiguity in fast-uri allows attackers to silently bypass SSRF denylists, redirect allowlists, and proxy routing rules by submitting URLs containing unbalanced authority brackets. Affected versions 2.4.5, 3.1.6, and 4.1.3 of the Fastify ecosystem URI parsing library return the malformed bracket-containing string as the host without raising an error, while Node.js's URL implementation and downstream HTTP clients resolve the same string to an entirely different host. Any application that reads the fast-uri-parsed host to enforce a security policy, then passes the original URL to an HTTP client, evaluates its controls against a string that is never the host the request actually reaches.

GitHub Enterprise Server SSRF chain delivers remote code execution by allowing malicious pre-receive hook code to impersonate trusted internal GHES services and redirect requests to privileged internal endpoints. All GHES versions prior to 3.22 are affected; GitHub has released patches across five supported branches (3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5). No public exploit code or CISA KEV listing exists at time of analysis, and exploitation requires both a non-default networking configuration and at minimum write-level repository access, materially limiting realistic attacker population.

SSRF in GitHub Enterprise Server (all versions prior to 3.22) allows unauthenticated network attackers to force the Manage API to issue gateway-to-agent requests toward an attacker-controlled host, and - by intercepting those outbound requests - capture a weakly-scoped HMAC token replayable against privileged management agent endpoints. The flaw arises from an unauthenticated cluster-configuration parsing endpoint combined with an HMAC scheme that signs only a timestamp, leaving request paths and bodies unsigned and the captured token replayable with arbitrary content. Vendor-released patches are available across five supported branches (3.17.19, 3.18.13, 3.19.10, 3.20.6, 3.21.4); no public exploit code and no CISA KEV listing have been identified at time of analysis.

Pre-authentication server-side request forgery in the SonicWall SMA1000 secure-access appliance's Work Place interface lets a remote unauthenticated attacker abuse an unintended alternate access path to reach internal/sensitive functionality and perform unauthorized operations. It affects SMA1000 firmware up to and including 12.4.3-03453 and 12.5.0-02835 (platform-hotfix builds and older), carries a maximal CVSS of 10.0, and has publicly available exploit code. SonicWall SMA appliances have been a repeated target of real-world attacks, and reporting ties this to broader SMA exploitation activity, though CISA KEV listing is not confirmed in the provided data.

Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the bypass of a prior known CVE fix elevates realistic risk above the AC:H score alone implies.

Server-side request forgery in Kyverno's Kubernetes admission controller (all versions before 1.18.0) enables any authenticated cluster user to redirect the admission controller's privileged HTTP client to cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), internal ClusterIP services, and loopback addresses by injecting malicious URLs through JMESPath variable substitution in ClusterPolicy `apiCall.service.url` definitions. Critically, this is non-blind SSRF: response bodies are reflected back to the attacker through admission error messages visible in kubectl output, enabling direct credential and data exfiltration in a single API call. A fully functional proof-of-concept is published in GHSA-qr4g-8hrp-c4rw; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Stored cross-site scripting in LibreNMS through 26.4.0 lets an administrator (or an attacker who has hijacked an admin session) chain an SSRF into persistent XSS by pointing the admin-configurable Oxidized integration URL (oxidized.url) at an attacker-controlled server. That server returns malicious JSON whose name, ip, model, author, and commit-message fields are rendered into the device showconfig page without htmlspecialchars(), so any user viewing any device's showconfig tab executes attacker-supplied JavaScript. A proof-of-concept mock Oxidized server has publicly confirmed the injection; no active exploitation is listed in CISA KEV.

Incomplete patch coverage in Wallos, the self-hosted subscription tracker, leaves a second unauthenticated logo-search endpoint (`endpoints/payments/search.php`) vulnerable to SSRF via HTTP proxy header injection - an oversight from the fix for CVE-2026-33407. Wallos prior to 5.0.0 passes the `HTTP_PROXY`/`HTTPS_PROXY` environment variable directly into cURL's `CURLOPT_PROXY`, allowing any unauthenticated network attacker to force the server's outbound HTTP requests through an attacker-controlled proxy. No active exploitation is confirmed (not in CISA KEV) and no public POC is referenced in available data, but the attack requires no credentials and no special configuration.

SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct the server to issue arbitrary outbound HTTP requests, including to cloud provider metadata services and internal network hosts. All Wallos releases prior to 4.9.6 are affected; the OIDC callback handler at includes/oidc/handle_oidc_callback.php:18-49 passes admin-supplied token_url and user_info_url directly to curl_init() without the validate_webhook_url_for_ssrf() protection already applied to logo and webhook URL fields. No public exploit has been identified at time of analysis, and a confirmed vendor patch is available in v4.9.6 released 2026-06-22.

Server-side request forgery in Wallos prior to version 4.9.6 enables authenticated users to force the server's PHPMailer instance to connect to any attacker-specified host and port by supplying crafted smtpaddress and smtpport values to the test email notification endpoint. The flaw is a coverage gap - every other notification endpoint applies the application's ssrf_helper.php guard, but testemailnotifications.php was omitted. An authenticated attacker can probe internal network services and query cloud metadata APIs such as AWS IMDSv1, potentially harvesting cloud credentials. No public exploit or CISA KEV listing is identified at time of analysis; a vendor patch is available as v4.9.6.

SSRF protection bypass in elFinder's URL upload feature allows remote attackers to reach internal HTTP services by exploiting a DNS rebinding race condition in `php/elFinder.class.php` prior to version 2.1.70. The server stores the internal service's HTTP response body as an uploaded file that is subsequently readable through the elFinder interface, making this a non-blind SSRF - a more impactful variant than typical SSRF. A public proof-of-concept is available via the GHSA advisory; no active exploitation has been confirmed in the CISA KEV at time of analysis.

Server-Side Request Forgery and structured file disclosure in oasdiff-action prior to version 0.0.51 allows unauthenticated remote attackers to make the GitHub Actions runner fetch arbitrary URLs or read filesystem paths by embedding malicious `$ref` entries in an attacker-controlled OpenAPI spec. The vulnerability is directly exploitable via fork pull requests on public repositories, requiring no interaction from maintainers beyond the normal CI workflow execution. No public exploit has been identified, but the fix PRs (128-130) provide a clear technical blueprint of the attack surface.

Cross-tenant tool execution in MCPHub before v1.0.30 allows any authenticated non-admin user to invoke tools on MCP servers owned by other tenants, bypassing the ownership enforcement that correctly gates list views and configuration edits. Because each registered MCP server runs with the capabilities and credentials of its owner - filesystem access, cloud API keys, HTTP-fetch tools - an attacker with any valid session can exfiltrate victim-owned secrets (demonstrated: /etc/passwd, user secrets) and trigger SSRF against internal services using the victim server's context. No public exploit code is independently circulating at time of analysis, but the GitHub advisory documents the attack technique, and the low complexity makes exploitation straightforward for any authenticated account holder.

MCPHub's SSRF guard can be circumvented by authenticated users who supply MCP server URLs containing IPv6 transition-format addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, or Teredo 2001::/32) that encode private IPv4 addresses, allowing requests to internal infrastructure the guard was designed to block. Versions prior to 1.0.32 are affected; the custom isBlockedIpv6 function in src/utils/ssrf.ts omits checks for these three address families. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. Vendor-released patch is available in v1.0.32 per GitHub advisory GHSA-pr4x-3pc7-2fhw.

Server-Side Request Forgery in MCPHub prior to v1.0.32 allows any authenticated non-admin user to register an arbitrary server URL, coercing the hub into issuing outbound HTTP requests with no egress filtering against loopback, RFC1918, or link-local 169.254.0.0/16 ranges. Via the OpenAPI proxy path, the full HTTP response body is reflected back to the caller, enabling exfiltration of data from internal services including cloud metadata endpoints; via SSE and streamable-HTTP transports, the requests are sent blind, enabling internal port scanning and service triggering. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Server-side request forgery in @pdfme/common before 5.5.10 allows attackers who control the basePdf template field to force SSR-context servers to issue arbitrary HTTP requests to internal endpoints without any URL validation. The unvalidated fetch() call in getB64BasePdf - reachable from the generator, UI hooks, and UI helper entry points - enables exfiltration from cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), blind network reconnaissance, and lateral pivot to internal APIs. A detailed proof-of-concept is embedded in GHSA-pgx6-7jcq-2qff; no CISA KEV listing is present at time of analysis.

Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level `raw` option. The `disableFileAccess` and `disableUrlAccess` flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a `MimeNode` is constructed for a `raw` message in `lib/mail-composer/index.js:34-35`, leaving the raw path completely unrestricted. Exfiltrated file contents or HTTP response bodies are delivered as the actual RFC822 message via every supported transport (SMTP, SES, sendmail, stream, JSON) to an attacker-controlled recipient. A local PoC is confirmed per GHSA-p6gq-j5cr-w38f; no KEV listing and no EPSS data are available.

Server-side request forgery in QD (qd-today), an open-source HTTP timed-task/check-in framework, lets remote unauthenticated attackers coerce the server into issuing arbitrary HTTP(S) requests. The unauthenticated /har/test endpoint passes user-supplied JSON into Fetcher.build_request() (libs/fetcher.py), which builds a Tornado HTTPRequest with no validation of URL scheme, host, or IP range and with TLS verification disabled (validate_cert=False), so an attacker can reach internal services and cloud metadata endpoints. CVSS is 9.1; no public exploit identified at time of analysis, though a referenced GitHub gist may contain technical detail.

SSRF filter bypass in WWBN AVideo exposes cloud metadata services and loopback interfaces to authenticated low-privilege attackers. The isSSRFSafeURL function fails to normalize IPv6 NAT64 addresses rendered in hexadecimal notation, allowing crafted URLs such as 64:ff9b::a9fe:a9fe to resolve to protected addresses like 169.254.169.254 while evading the SSRF blocklist. Exploitation could yield cloud instance credentials or access to internal services; no public exploit or KEV listing is confirmed at time of analysis.

Server-side request forgery in jina-ai reader allows unauthenticated remote attackers to reach cloud metadata services and internal HTTP endpoints by supplying publicly resolvable hostnames that map to private IP addresses. The private-address guard - intended to block RFC 1918 and metadata service IPs - is only enforced when the service runs inside Google Cloud, leaving all other deployment environments (AWS, Azure, on-premises) completely unprotected by this control. Successful exploitation in cloud-hosted deployments can yield instance metadata including IAM credentials and access tokens. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.

Unauthenticated file read, SSRF, and arbitrary file write affect the 爱采集数据采集和发布插件 (an auto-collection/scraping-and-publishing) WordPress plugin through version 1.0.0, because one of its unauthenticated endpoints trusts a hardcoded default secret instead of a per-install value and fails to validate supplied URLs and destination paths. Remote attackers with no authentication can read arbitrary server files, coerce the server into issuing arbitrary outbound requests and returning the responses, and write attacker-controlled content outside the uploads directory. Publicly available exploit code exists (reported by WPScan), though EPSS remains low at 0.14% (3rd percentile).