Server-Side Request Forgery

Server-Side Request Forgery in Sonatype Nexus Repository 3 allows any holder of the Capability Administration permission to redirect the server's outbound HTTP requests to arbitrary internal network addresses by supplying a crafted URL in the Webhook Global capability configuration, enabling probing of internal infrastructure. The vulnerability is patched in version 3.94.0 per Sonatype's release notes. No public exploit code exists and the vulnerability is not in CISA KEV, but risk escalates materially on instances where the anonymous role has been granted the Capability Administration permission, as this exposes the SSRF to unauthenticated actors without any configuration changes beyond that role assignment.

Server-Side Request Forgery in Sonatype Nexus Repository 3 exposes internal network infrastructure to authenticated users holding the nexus:ssl-truststore:read permission, who can weaponize the SSL Certificate Retrieval endpoint to force the server to initiate outbound TCP connections to arbitrary hosts - including cloud metadata services, internal APIs, and otherwise firewalled systems. All versions from 3.0.0 up to (but not including) 3.94.0 are affected, and a vendor-released patch is available. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Server-side request forgery in Easy!Appointments prior to 1.6.0 allows authenticated backend users - admins, providers, or secretaries - to probe internal network hosts by supplying arbitrary URLs to the CalDAV synchronization endpoint. The Guzzle HTTP client in `Caldav.php:60` forwards a REPORT request to the caller-supplied `caldav_url` without validating the scheme or destination host, enabling access to loopback, RFC1918, and link-local addresses on the deployment network. The SSRF is semi-blind, returning up to approximately 120 bytes of upstream response body through the exception path; no public exploit has been identified, exploitation requires an active backend account, and version 1.6.0 resolves the issue.

Server-side request forgery in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows unauthenticated network attackers to weaponize the device as an HTTP proxy against internal or external hosts. Exploitation requires the optional Node-RED plugin to be installed and leverages the known default passphrase 'opendoor' to bypass authentication to the plugin interface - dramatically lowering the practical barrier for blind SSRF. A publicly available proof-of-concept exploit exists per ZeroScience advisory ZSL-2026-5998; no CISA KEV listing at time of analysis.

Memory exhaustion in elixir-mint's HTTP/2 client library (mint) allows a malicious or attacker-controlled HTTP/2 server to crash any BEAM application using the library by streaming unbounded zero-length CONTINUATION frames that bypass the existing byte-size guard. Affected versions span mint 0.1.0 through 1.9.1; a vendor-released patch is confirmed in 1.9.2. No public exploit or CISA KEV listing exists at time of analysis, but the explicit SSRF and redirect attack vectors meaningfully increase realistic exposure for server-side Elixir applications that proxy user-supplied URLs.

Server-side request forgery in louisho5 picobot up to version 0.2.0 allows authenticated remote attackers to manipulate the url argument of the WebTool.Execute function in internal/agent/tools/web.go, causing the server to issue arbitrary HTTP requests to internal or external targets. The vulnerability carries a CVSS 4.0 score of 5.3 with low-privilege authentication required and has publicly available exploit code disclosed via a GitHub issue report. The upstream project has not responded to the responsible disclosure, meaning no patch is available at time of analysis.

Server-side request forgery in zhayujie CowAgent's Vision Tool allows authenticated remote attackers to make the server issue arbitrary HTTP requests to internal network resources. The vulnerability exists in the Vision._download_to_data_url / _build_image_content function in agent/tools/vision/vision.py, where the image argument is passed to an HTTP fetch without URL validation, enabling access to private RFC1918 addresses, loopback interfaces, and other non-public infrastructure. A publicly available proof-of-concept exploit exists (GitHub issue #2878), and a vendor-released patch (version 2.1.2) is available.

Server-side request forgery in GoClaw 3.13.3-beta.3 enables authenticated remote attackers to manipulate the `output.video_url` parameter within the `bytePlusDownloadVideo` function, coercing the server into issuing HTTP requests to attacker-controlled destinations including internal network resources. The flaw resides in `internal/tools/create_video_byteplus.go` at the invoke endpoint. A proof-of-concept exploit has been publicly disclosed via GitHub issue #1199; however, no CISA KEV listing confirms mass active exploitation, and the CVSS 4.0 score of 2.1 reflects the low-privilege authentication barrier and limited per-request impact scope.

Server-side request forgery in mosaxiv clawlet up to version 0.2.10 allows remote attackers to manipulate the server into issuing arbitrary HTTP requests by supplying a crafted URL to the web_fetch function in tools/tool_web_fetch.go via the IPv4 Handler. The CVSS 4.0 score of 2.1 reflects limited practical impact, constrained further by a user-interaction requirement (UI:P) and low CIA impact metrics. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental vector), and the upstream maintainer has closed the tracking issue as 'not planned', meaning no official fix will be released.

Server-side request forgery in mosaxiv clawlet up to version 0.2.10 enables authenticated remote attackers to manipulate the webFetch tool function to issue arbitrary HTTP requests from the server, potentially reaching internal services, cloud metadata endpoints, or other network resources not directly accessible to the attacker. A publicly available proof-of-concept exploit was disclosed via GitHub issue #14, making real-world exploitation more accessible. Critically, the upstream maintainer closed the issue as 'not planned,' meaning no vendor-released patch is forthcoming and the vulnerability will remain permanently unaddressed in the existing codebase.

OpenClaw's browser CDP (Chrome DevTools Protocol) discovery component fails to enforce its own URL blocklist, allowing lower-trust authenticated users to reach network destinations that OpenClaw policy should have denied access to. The root cause is a Server-Side Request Forgery variant (CWE-918) where blocked WebSocket URLs submitted through CDP discovery are accepted and proxied without policy enforcement. The CVSS 4.0 vector (SC:H/SI:L) confirms the primary impact lands on downstream or segmented network resources - not OpenClaw itself - making this a network segmentation bypass rather than a direct system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.

Server-side request forgery in Laravel-Mediable before 7.0.0 enables network-accessible, low-privilege attackers to issue arbitrary HTTP requests originating from the server by supplying unvalidated URLs to any application endpoint backed by MediaUploader::fromSource(). The RemoteUrlAdapter class accepts caller-controlled URLs without restricting schemes, IP ranges, or hostnames, allowing requests to RFC-1918 addresses, loopback interfaces, file:// URIs, and cloud instance metadata endpoints such as AWS IMDSv1 at 169.254.169.254. In cloud deployments, successful exploitation can yield IAM temporary credentials, enabling privilege escalation far beyond the base CVSS score of 5.3 would suggest. No public exploit or CISA KEV listing exists at time of analysis.

Stored Server-Side Request Forgery in Decidim's push notification subsystem allows any authenticated user to register an arbitrary HTTPS URL as a push subscription endpoint, causing the application server to issue outbound POST requests to that attacker-controlled destination whenever notifications are dispatched. The vulnerability exists in the decidim-core RubyGem across versions below 0.30.9, 0.31.0.rc1 through 0.31.4, and 0.32.0.rc1, and is only exploitable when VAPID push delivery is configured. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but a vendor-confirmed patch and source-code-level proof of the source-to-sink chain are available via the GHSA advisory.

Server-Side Request Forgery in the Themeisle Auto Featured Image (Auto Post Thumbnail) WordPress plugin through version 5.0.4 enables authenticated low-privilege users to coerce the server into issuing arbitrary outbound HTTP requests to attacker-controlled destinations, including internal network resources. The CVSS scope change (S:C) confirms the vulnerability can reach resources outside the WordPress application boundary - such as cloud metadata endpoints, internal APIs, or services on the hosting network. No public exploit identified at time of analysis, and SSVC assessment confirms no observed exploitation with non-automatable attack conditions.

Server-Side Request Forgery in bdthemes Instant Image Generator (WordPress plugin ai-image) through version 2.1.4 allows low-privileged authenticated users to coerce the WordPress server into issuing HTTP requests to arbitrary destinations. The scope-changed CVSS vector (S:C) confirms the server can be directed at internal infrastructure beyond the WordPress installation itself, enabling internal network probing or cloud metadata endpoint access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Authenticated SSRF in Apache Gravitino's JobManager component (versions 1.0.0 through 1.2.1) enables authenticated users to coerce the server into making arbitrary outbound HTTP requests to internal network hosts and cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254, GCP metadata endpoints) by supplying unvalidated URIs within job templates. In cloud-hosted deployments this is a credential-theft primitive: metadata service access can yield IAM role credentials with blast radius extending well beyond the Gravitino service itself. No public exploit or CISA KEV listing has been identified at time of analysis; vendor labels severity as moderate, though cloud-metadata reachability elevates real-world impact above that rating in typical deployment contexts.

Server-side request forgery in kLOsk adloop through version 0.9.0 allows authenticated remote attackers to manipulate the `final_url` argument passed to the `_validate_urls` function in `src/adloop/ads/write.py`, causing the server to issue arbitrary outbound HTTP requests. Internal network services, cloud metadata endpoints, and other non-public resources reachable from the server may be exposed. A public proof-of-concept exploit exists via GitHub issue #41, and a vendor-released patch is available in version 0.10.0.

Server-Side Request Forgery in LogicalDOC Enterprise versions up to and including 9.1.1 lets a remote, unauthenticated attacker abuse the ShareFileCallback servlet to coerce the server into issuing HTTP requests to an attacker-chosen host. Because no credentials are required and the flaw is network-reachable, it can be used to probe internal networks, reach otherwise-firewalled services, and potentially retrieve cloud metadata. A public technical disclosure exists (netero1010 Vulnerability-Disclosure repository); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.

Server-side request forgery in Helicone ai-gateway (up to 0.2.0-beta.30) allows a low-privileged remote attacker to manipulate the `extracted_path_and_query` argument within the `build_target_url` function of the AWS Metadata Service component, causing the gateway to issue unauthorized server-side HTTP requests to internal infrastructure. For deployments on AWS, this most critically targets the EC2 Instance Metadata Service (IMDS) at 169.254.169.254, potentially exposing IAM role credentials that carry blast radius far exceeding the assigned CVSS 5.3 score. A public exploit exists via GitHub, and the vendor was unresponsive to pre-disclosure contact, meaning no vendor-confirmed patch is available at time of analysis.

Server-side request forgery in AstrBot's dashboard MCP Test Endpoint allows low-privileged authenticated users to coerce the server into issuing arbitrary HTTP requests via a manipulated `mcp_server_config.url` parameter. All AstrBot versions through 4.25.2 are affected via the `ToolsRoute.test_mcp_connection` function in `astrbot/dashboard/routes/tools.py`. A publicly available proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no vendor-issued patch at time of analysis.

Server-side request forgery in AstrBot up to version 4.25.2 allows authenticated remote attackers to cause the server to issue arbitrary HTTP requests by supplying a malicious value for the `custom_registry` parameter at the `market_list` plugin marketplace endpoint. The affected function is `get_online_plugins` in `astrbot/dashboard/routes/plugin.py`. A public proof-of-concept exploit is available on GitHub, though this vulnerability is not listed in the CISA KEV catalog. The CVSS 4.0 score of 2.1 reflects the authentication barrier and constrained impact, making this a lower-priority but tactically exploitable issue for attackers with dashboard access.

Server-Side Request Forgery in Drupal Core allows authenticated low-privilege users to coerce the application server into issuing unauthorized HTTP requests to internal or restricted network destinations. All active 10.6.x and 11.x release branches are affected, along with end-of-life 11.0.x and 11.1.x branches, covering a broad swath of production Drupal deployments. No public exploit code has been identified and EPSS sits at the 3rd percentile, but the large Drupal deployment footprint elevates aggregate exposure even at low per-instance exploitation probability.

Server-Side Request Forgery in the Drupal OpenAI Provider module enables authenticated administrators to force the server to issue HTTP requests to attacker-controlled destinations, potentially reaching internal network resources beyond the intended API boundary. Affected versions span 0.0.0 through 1.1.1 and 1.2.0 through 1.2.2; a vendor patch is available via Drupal security advisory SA-CONTRIB-2026-053. No public exploit code exists, EPSS sits at 0.14% (4th percentile), and SSVC confirms exploitation status as none - all signals converge on a low operational priority despite the network-accessible attack vector.

Server-Side Request Forgery in Misskey's UrlPreviewService allows remote unauthenticated attackers to coerce the platform's backend into initiating outbound HTTP connections toward loopback addresses, RFC-1918 private ranges, and link-local networks. The root cause is that IP address validation is applied only after the TCP connection has already been established, meaning the outbound request reaches the internal target before the check rejects it. Per vendor disclosure, response data is not believed to be returned to the attacker, limiting the impact to blind SSRF with potential for triggering internal service side effects. No public exploit identified at time of analysis, and a fix is available in version 2026.6.0.

GNU Wget's FTP passive mode implementation fails to validate the IP address returned in a server's PASV response, enabling a malicious FTP server - or any HTTP server issuing a redirect to an ftp:// URL - to redirect Wget's data connection to an arbitrary internal IP address and port. All Wget releases through 1.25.0 (prior to upstream commit 4f85853) are affected, exposing any host running Wget to server-side request forgery (SSRF) that can probe or interact with localhost services and internal network resources. No confirmed active exploitation exists (SSVC: exploitation none), and no public POC exploit has been identified at time of analysis; the NVD-provided CVSS attack vector (AV:L) appears inconsistent with the network-based attack mechanism and may be an error.

Server-side request forgery in Kimai 2.56.0 allows authenticated users with write access to Markdown-rendered invoice fields to force the application server to issue outbound HTTP requests to attacker-controlled or internal network destinations. The vulnerability surfaces during invoice PDF preview and generation, where user-controlled Markdown is processed through an md2html filter and handed to mPDF, which fetches embedded image URLs server-side even with safe mode enabled. A proof-of-concept was developed and responsibly disclosed to the vendor - it is not publicly available - and no active exploitation has been confirmed; however, the attack path is mechanically simple for any user with access to customer invoice text fields such as Customer.invoiceText.

Unauthenticated blind SSRF via DNS rebinding in PraisonAI before 4.6.78 allows remote attackers to reach internal services through the Jobs API /api/v1/runs endpoint without credentials. The webhook_url parameter is validated at request intake but re-resolved at connection time, creating a TOCTOU window exploitable by an attacker who controls a malicious DNS server - flipping the resolved IP from a legitimate external address to an internal target after validation passes. No public exploit code or CISA KEV listing exists at time of analysis; the unauthenticated network vector (AV:N/PR:N) makes this a meaningful risk for any internet-exposed PraisonAI deployment, particularly in cloud environments where internal metadata APIs may be reachable.

Server-Side Request Forgery in the All-in-One Video Gallery WordPress plugin (all versions through 4.8.5) enables a two-stage attack where a subscriber-level authenticated user plants an internal or loopback URL into a video post's mp4 meta field via the XML-RPC wp.newPost method, then any unauthenticated party can trigger the ?vdl=<post_id> endpoint to force the server to fetch that URL and stream the full response body - enabling reconnaissance of internal services including cloud metadata endpoints. The CVSS scope change (S:C) captures the critical decoupling: subscriber-level credentials are needed only for setup, while the actual SSRF trigger requires no authentication at all. No public exploit identified at time of analysis, though the Wordfence advisory documents the complete attack chain with specific code line references.

Server-side request forgery in zhayujie CowAgent versions up to 2.1.1 allows remote unauthenticated attackers to manipulate the `image` argument passed to `_build_image_content` or `_download_to_data_url` within the Vision Tool component, forcing the server to issue arbitrary outbound HTTP requests to attacker-specified destinations. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication and no special conditions, making this trivially accessible over the network. Exploit code has been publicly disclosed (CVSS 4.0 E:P per VulDB submission), raising real-world risk; no CISA KEV listing exists at time of analysis, so confirmed mass exploitation is not established.

Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows remote attackers to manipulate the WebFetchTool.Execute function within the Guarded Web Fetch Flow component, causing the server to issue arbitrary outbound requests on behalf of the attacker. The vulnerability carries a CVSS 4.0 base score of 2.1, reflecting limited confidentiality, integrity, and availability impact with no subsequent-system scope change. A public exploit has been released (E:P confirmed), but no vendor patch exists - the upstream GitHub issue was closed automatically due to inactivity, not resolution.

Server-side request forgery in Palo Alto Networks PAN-OS allows an authenticated administrator with access to the management web interface to weaponize the firewall as an unauthorized network relay, making requests to internal services on behalf of the attacker. Exploitation is constrained by the requirement for high-privilege administrator credentials (PR:H) and network reachability to the management interface, substantially limiting the realistic attacker population. No public exploit code or active exploitation has been identified; the vendor's own CVSS 4.0 supplemental metrics rate exploitation status as Unreported (E:U) and urgency as Amber.

Server-side request forgery in aerostackdev aerostack-mcp's mcp-whatsapp component allows authenticated remote attackers to manipulate the `media_url` argument of the `upload_media` function, causing the server to issue arbitrary outbound HTTP requests on the attacker's behalf. Affected installations span all commits up to 6315dfde7df0a15aaf743f88d91347115e09ba23 with no vendor patch available and no maintainer response to the disclosure. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

SSRF protection bypass in pyload-ng allows authenticated users with link-add permissions to reach internal network endpoints - including cloud metadata services - by supplying IPv6 transition-encoded addresses that Python's `ipaddress.IPv6Address.is_global` incorrectly classifies as globally routable. The NAT64 prefix (`64:ff9b::/96`) bypass is universal across all supported Python versions (3.9-3.14); the 6to4 prefix (`2002::/16`) bypass additionally affects Python 3.9-3.11, covering the full `python_requires = >=3.9` matrix. No confirmed active exploitation (CISA KEV) has been identified, but a researcher-provided proof-of-concept demonstrates full bypass of both the `is_global_address` guard and the pycurl PREREQFUNC in `http_request.py:680`.

Server-Side Request Forgery in the Fediverse Embeds WordPress plugin before 1.5.8 allows unauthenticated remote attackers to make the WordPress server fetch arbitrary internal and private-network URLs via an unvalidated site-info endpoint. The nonce intended to gate access to this endpoint is inadvertently rendered into the HTML of any public page carrying a Fediverse embed, making the authentication bypass trivial for any site visitor. A publicly available exploit exists per WPScan; no confirmed active exploitation (KEV absent) but the attack is fully automatable per SSVC assessment.

Unauthenticated full-read SSRF in the Fediverse Embeds WordPress plugin (all versions before 1.5.8) exposes any internal or cloud-metadata URL reachable from the WordPress server's network to anonymous attackers via an unvalidated media-proxying endpoint. The endpoint also acts as an open proxy, returning the complete response body to the requester. A publicly available exploit has been published by WPScan, and the SSVC framework marks the vulnerability as automatable, though EPSS sits at just 0.13% (3rd percentile), indicating limited observed mass exploitation at time of analysis.

Open redirect and client-side SSRF in Gradio before 6.20.0 expose cloud infrastructure credentials to network attackers via the /gradio_api/file= endpoint. The file_fetch() function accepts unvalidated HTTP/HTTPS URLs from attacker-controlled FileData responses, enabling redirection of victim browsers to arbitrary destinations including cloud metadata services such as the EC2 instance metadata endpoint (169.254.169.254). Successful exploitation in cloud-hosted Gradio deployments allows retrieval of IAM role credentials, achieving high subsequent-system confidentiality impact. No public exploit or CISA KEV listing is identified at time of analysis; a fix is available in version 6.20.0.

Server-Side Request Forgery in Python Zeep 4.0.0 through 4.3.2 allows an attacker who can influence WSDL or XSD content parsed by the library to bypass the explicit `Settings.forbid_external` security control, causing the server to issue HTTP or HTTPS requests to attacker-chosen URLs via transitive xsd:import, xsd:include, wsdl:import, or lxml entity and DTD references. The vulnerability is particularly significant because it defeats a documented security setting that developers actively configure to prevent external fetching - applications relying on this control are silently unprotected. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Security-control bypass in oasdiff v1.13.2-v1.18.0 silently negates the `--allow-external-refs=false` safety flag when loading OpenAPI specifications via the git-revision input form (`rev:path`, e.g. `main:openapi.yaml`), leaving callers exposed to SSRF and local file disclosure despite explicitly intending to sandbox untrusted spec processing. Malicious `$ref` URIs embedded in a spec - pointing to internal HTTP endpoints or local filesystem paths - are resolved on the git-revision load path even when the policy is set, while the file-path and URL load paths correctly enforce the restriction. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; vendor-released patch v1.18.1 is available.

SSRF filter bypass in CKAN MCP Server (@aborruso/ckan-mcp-server) allows a low-privileged remote MCP caller to reach loopback and private network addresses by supplying hostname aliases such as 'ip6-localhost' as the server_url parameter to CKAN tools like ckan_package_search and sparql_query. The prior remediation for CVE-2026-33060 hardened only against dotted IPv4 literals, bracketed IPv6 literals, and the exact string 'localhost', leaving non-canonical loopback aliases unblocked in src/utils/http.ts. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV; however, the bypass technique is straightforward given knowledge of the prior fix.

Server-side request forgery in NocoBase through v2.1.20 allows authenticated administrators to issue arbitrary outbound HTTP requests via the serverRequest wrapper, enabling internal network enumeration and cloud instance metadata exfiltration. The attack surface spans workflow request nodes, custom request action buttons, and the AI plugin - all of which accept administrator-supplied URLs without adequate server-side validation. A publicly available proof-of-concept exists per VulnCheck reporting; no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis, though the IAM credential theft potential elevates real-world impact significantly for cloud-hosted deployments.

Server-Side Request Forgery (SSRF) in Coolify's GitHub App integration exposes internal network services and cloud metadata endpoints to authenticated low-privilege users. Versions prior to 4.0.0-beta.471 allow any authenticated user to set the GithubApp api_url field to an arbitrary URL - including RFC 1918 private addresses or cloud instance metadata endpoints like 169.254.169.254 - which Coolify then fetches server-side without restriction. No public exploit identified at time of analysis, but the attack pattern is well understood and particularly dangerous in cloud-hosted deployments where metadata endpoints may expose IAM credentials.

Server-Side Request Forgery (SSRF) in Coolify prior to v4.0.0-beta.474 enables an authenticated user holding storage management permissions to coerce the application server into issuing HTTP requests to arbitrary internal addresses, including cloud instance metadata services. The vulnerable code path is Coolify's S3 storage endpoint testConnection() function, which blindly fetches the caller-supplied URL after only superficial format validation. No public exploit or CISA KEV listing exists at time of analysis, but cloud-hosted deployments face elevated risk because successful exploitation can expose cloud provider credentials via metadata endpoints such as AWS IMDSv1.

Unauthenticated SSRF in Dragonfly's scheduler v1 gRPC service allows any remote client to force the scheduler to issue HTTP GET requests to arbitrary internal addresses, including loopback (127.0.0.1), cloud metadata endpoints (169.254.0.0/16), and RFC1918 ranges. The scheduler's `DownloadTinyFile()` function constructs HTTP requests from attacker-controlled `PeerHost.Ip` and `PeerHost.DownPort` gRPC fields with no destination address validation, and stores up to 128 bytes of each fetched response in `Task.DirectPiece`, which is subsequently served to other peers. The input tag of 'RCE' in the source intelligence is incorrect - this is a read-SSRF with a limited exfiltration path, not remote code execution. A fully confirmed proof-of-concept exists against v2.4.4-rc.2; no patched release version has been identified at time of analysis.

Build-time SSRF in Hugo static site generator (v0.162.0-v0.163.0) allows bypass of the `security.http.urls` IP-block policy by supplying loopback or cloud-metadata addresses in alternate IPv4 encodings - integer, hex, or octal - that the deny rule does not recognize but the cgo system resolver silently normalizes and resolves. Templates invoking `resources.GetRemote` with attacker-influenced or data-derived URLs can reach internal services and cloud-metadata endpoints (e.g., AWS IMDSv1) at build time, a particularly acute risk in CI pipelines and hosted build services where instance credentials are accessible. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the fix is available in v0.163.1.

Server-Side Request Forgery in the Anti-Virus for ownCloud extension (versions before 1.2.3, shipping with ownCloud 10 prior to 10.15.3) lets an authenticated high-privileged user coerce the server into issuing attacker-controlled requests, with a scope-changed CVSS of 9.1 reflecting reach into internal systems. The flaw was reported through ownCloud's security advisory program (GHSA-3wg4-mg27-hj4w); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor-released patch exists: Anti-Virus for ownCloud 1.2.3 / ownCloud 10.15.3.

Server-side request forgery escalating to remote code execution in the SharePoint for ownCloud app (versions prior to 0.4.1, bundled with ownCloud 10 before 10.15.3) lets an already-authenticated administrator coerce the server into making attacker-controlled requests that ultimately run arbitrary code on the host. The flaw is tagged RCE/SSRF and carries an 8.5 CVSS with a scope change (S:C), reflecting that abuse of the SharePoint integration crosses a trust boundary into the underlying system. No public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-and-move-on issue rather than an active-threat emergency.

Server-side request forgery in the mcp-wiki/wiki-summary component of AIAnytime Awesome-MCP-Server (up to commit a884bb51) allows a remote, low-privileged attacker to manipulate the `url` argument in `mcp-wiki/src/mcp_wiki/server.py`, causing the server to issue arbitrary HTTP requests to internal or external resources on the attacker's behalf. Successful exploitation can expose internal services, cloud metadata endpoints, or other backend infrastructure inaccessible from the public internet. A publicly available exploit exists (POC confirmed via GitHub issue #35); this CVE is not currently listed in CISA KEV. The CVSS 4.0 score of 5.3 reflects a moderate severity with low-privilege authentication required and partial confidentiality, integrity, and availability impact.

Server-Side Request Forgery (SSRF) via HTTP redirect in Gitea's repository migration feature affects all versions through 1.25.4, allowing an authenticated attacker to coerce the Gitea server into issuing HTTP requests to arbitrary internal network destinations by supplying a crafted migration URL that redirects to an internal address. The CVSS score of 6.5 (C:H) reflects that successful exploitation can expose sensitive internal service responses - including cloud metadata endpoints, internal APIs, or other intranet services - to the attacker. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available in v1.26.3 and v1.26.4.

Server-side request forgery in Microsoft Edge (Chromium-based) versions before 150.0.4078.48 enables unauthenticated remote attackers to perform network spoofing by inducing the browser to issue forged requests on behalf of a victim. The attack requires user interaction - a victim must visit or interact with attacker-controlled content - after which the browser can be coerced into making unauthorized requests that manipulate resource integrity or availability. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; a vendor-released patch is available.

Server-side request forgery in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 allows unauthenticated network attackers to perform spoofing by inducing a victim user to visit a malicious page, causing the browser to issue forged requests to internal or external resources. The confidentiality impact is rated High (CVSS C:H), indicating that sensitive data accessible via the browser's network context may be exfiltrated through the SSRF channel. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Server-Side Request Forgery in WP Import Export Lite (all versions ≤ 3.9.30) allows authenticated administrators to bypass WordPress's native SSRF protections and reach internal network resources, including cloud instance metadata endpoints. The bypass exploits a design flaw: when WordPress's wp_safe_remote_get() correctly blocks a private-range URL and returns a WP_Error, the plugin's Download::download_file() method interprets that error as a cue to retry the original attacker-supplied URL via GuzzleHttp with no filtering and TLS verification disabled. No public exploit is identified at time of analysis and no CISA KEV listing exists, but the cloud credential theft scenario on hosted WordPress environments elevates practical impact beyond the 5.5 base score.

Server-side request forgery in AutoBangumi before 3.2.8 allows unauthenticated remote attackers to probe internal network services by submitting arbitrary host values to the unprotected POST /api/v1/setup/test-downloader endpoint during the application's initial setup window. The server issues outbound HTTP GET requests to attacker-controlled targets - including internal or reserved IP ranges - and leaks reachability data through echoed connection-error responses, enabling internal network mapping. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; the CVSS 4.0 base score is 6.9 (Medium), reflecting unauthenticated network access with limited confidentiality impact.

Server-Side Request Forgery (SSRF) in the GeoDirectory WordPress plugin (versions 2.8.161 and earlier) allows authenticated subscribers to force the server to issue arbitrary internal or external HTTP requests. Because the vulnerability is accessible at the lowest WordPress registered-user privilege level (subscriber), any registered site user can trigger it without elevated permissions. No public exploit or CISA KEV entry has been identified at time of analysis, but the Scope:Changed CVSS rating confirms the impact extends beyond the WordPress application itself to backend infrastructure reachable from the server.

Server-Side Request Forgery in liboauth2 prior to version 2.3.0 allows an unauthenticated attacker to force any application using the AWS ALB JWT verification path to issue GET requests to arbitrary internal network paths. The vulnerability exists because the `oauth2_jose_jwks_aws_alb_resolve()` function reads the unverified `kid` JWT header field and appends it directly to the configured `alb_base_url` - without URL encoding or path sanitization - before any cryptographic signature check occurs. No public exploit code has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for AWS-integrated deployments where liboauth2 handles ALB token verification.

Unvalidated bearer realm URL handling in oras-go v2 ≤ 2.6.0 enables two distinct attack primitives against users who run oras operations against a malicious, compromised, or man-in-the-middle'd registry: server-side request forgery (SSRF) to internal network endpoints including cloud instance metadata services, and TLS downgrade that exposes user credentials in plaintext. The OCI distribution spec legitimately allows cross-host realm references for split-auth deployments (e.g., Docker Hub's auth.docker.io pattern), but oras-go failed to block private IP literals, loopback addresses, and scheme downgrades from https to http - patterns that are never legitimate under any valid registry trust model. No active exploitation has been confirmed (not in CISA KEV), and a patch is available in v2.6.1.

Helm credential exfiltration in Rancher Fleet allows an attacker with git push access to a Fleet-monitored repository to redirect configured Helm BasicAuth credentials to an attacker-controlled server by manipulating the `helm.repo` field inside a committed `fleet.yaml`. Affected deployments are those where `GitRepo` resources carry `helmSecretName` or `helmSecretNameForPaths` but lack a `helmRepoURLRegex` allowlist - the default state for most pre-patch installations across the v0.12, v0.13, v0.14, and v0.15 release lines. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the low attack complexity and clear credential-theft path make this a meaningful supply-chain risk for organizations relying on private Helm repositories within Rancher-managed multi-cluster environments.

SSRF policy bypass in jshookmcp 0.3.1 allows an authenticated MCP client with network domain access to probe internal RFC 1918 and reserved addresses that are explicitly blocked by all other network tools on the same server. The `network_icmp_probe` and `network_traceroute` handlers call `resolveHostname` directly without invoking the central `resolveAuthorizedTransportTarget` guard, creating an inconsistent enforcement boundary. No CISA KEV listing exists, but proof-of-concept test code demonstrating the bypass via the `handleCallTool` dispatch path is included in the GitHub advisory (GHSA-c5r6-m4mr-8q5j), confirming exploitability without external traffic.

Server-side request forgery in Open WebUI before 0.6.27 enables authenticated users to bypass SSRF protections in the web retrieval endpoint by supplying URLs that trigger server-side HTTP redirects to internal network resources. The /api/v1/retrieval/process/web endpoint follows Location redirect headers without revalidating the destination against SSRF blocklists, exposing internal services and potentially instance secrets that could enable command execution. No public exploit code or active exploitation has been identified at time of analysis, but the authenticated escalation path to internal infrastructure warrants prompt patching.

Server-side request forgery in IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 enables authenticated attackers to coerce the server into issuing arbitrary outbound HTTP requests to attacker-controlled destinations. The CVSS vector (PR:L) confirms exploitation requires a valid account, but no elevated privileges are needed beyond basic authentication. Primary impact is internal network enumeration and potential pivoting to services that trust the watsonx.data host, rather than direct data exfiltration. No public exploit code or CISA KEV listing has been identified at time of analysis.

Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.9.3 allows a low-privileged authenticated user to coerce the server into making attacker-controlled internal requests by abusing the URL data-source component, where a Time-of-Check/Time-of-Use race condition lets a hostname resolve to a safe address during validation and a private/internal address at fetch time (classic DNS rebinding). Exploitation is rated CVSS 7.1 with a scope change, reflecting that the server can be made to reach internal services beyond its own trust boundary; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Server-Side Request Forgery (SSRF) in Foreman's HTTP proxy controller within Red Hat Satellite 6 allows high-privileged attackers to redirect internal HTTP requests to cloud metadata endpoints on AWS, GCP, and Azure environments. By manipulating HTTP parameters in the http_proxies_controller or http_proxy configuration files, an attacker can cause the Foreman server to issue forged requests to internal metadata services (e.g., AWS IMDS at 169.254.169.254), potentially harvesting IAM role credentials, access tokens, and environment configuration secrets. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, but the confidentiality impact is high given the value of cloud metadata credentials.

Server-side request forgery in Pinpoint APM through version 3.1.0 allows authenticated users with low privileges to register internal or cloud-metadata URLs as alarm webhook targets due to missing URL validation on the webhook registration endpoint. By deliberately triggering alarm threshold breaches, an attacker can coerce the Pinpoint server to issue outbound POST requests to internal hosts, cloud metadata services (such as AWS IMDS at 169.254.169.254), or other non-routable internal infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 subsequent-system confidentiality impact is rated High, reflecting the potential to enumerate internal services or harvest cloud credentials.

Server-side request forgery in GitBucket up to version 4.46.1 allows authenticated users to coerce the application server into issuing HTTP requests to arbitrary internal or private network hosts by supplying a crafted URL to the repository creation "clone from existing repository" feature. The flaw resides in `Git.cloneRepository.setURI()` within `RepositoryCreationService.scala`, where user-supplied URL input reaches JGit without validation against private address ranges. A public exploit exists (GitHub issue #4044), though no CISA KEV listing is present - no confirmed active exploitation at time of analysis. An upstream patch is available as commit 487a9b980f56aa73b6a044b1e86a92eed5043215 via PR #4056.

DNS rebinding SSRF in Aimeos Pagible CMS's administrative proxy route (`cmsproxy`) exploits a TOCTOU race condition between URL validation and HTTP request execution to bypass private-IP blocklists. Authenticated attackers with basic CMS access who control a TTL=0 DNS server can cause the application to fetch cloud metadata endpoints such as the AWS Instance Metadata Service (169.254.169.254), potentially returning IAM credentials to the attacker. A detailed, step-by-step proof-of-concept is publicly available via GitHub Advisory GHSA-mmj8-wcvw-6789; no active exploitation is confirmed in CISA KEV at time of analysis.

Server-Side Request Forgery in Canonical LXD's image import endpoint allows authenticated users holding the can_create_images entitlement to direct the LXD daemon to make arbitrary outbound HTTP connections, including to loopback addresses, RFC1918 private ranges, and cloud instance metadata services such as 169.254.169.254. Affected versions span 4.12 through 6.9. An attacker can leverage error-based responses to enumerate internal TCP ports and fingerprint internal HTTP services from the daemon's privileged network position, enabling lateral reconnaissance in multi-tenant or cloud-hosted environments. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV.

Server-Side Request Forgery in the Kirki WordPress customizer framework plugin (versions up to and including 6.0.11) allows authenticated subscriber-level users to induce the server to issue arbitrary HTTP requests to internal or external network destinations. The Scope:Changed CVSS designation confirms the exploit can pivot beyond the WordPress application itself to reach internal infrastructure. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the subscriber-level privilege requirement lowers the bar significantly for sites permitting open user registration.

Server-Side Request Forgery in the utm.codes WordPress plugin (versions ≤ 1.9.0) enables authenticated subscribers to induce the web server to issue arbitrary outbound HTTP requests, with the vulnerability scope extending beyond the plugin itself to potentially reachable internal network resources. The CVSS Scope:Changed rating reflects that a successful exploit can pivot the server's network identity to probe internal services, cloud metadata endpoints, or intranet hosts inaccessible to the attacker directly. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low attack complexity and subscriber-level privilege bar make this exploitable by any registered WordPress user on affected installations.

Server-side request forgery in the Mattermost Agents plugin MCP server (stdio mode) allows a low-privileged local attacker to make the server fetch arbitrary internal URLs submitted as file attachment references in post creation requests, enabling exfiltration of data from RFC 1918-addressed services on the internal network. Affected are Mattermost deployments running versions 10.11.x ≤ 10.11.18, 11.5.x ≤ 11.5.6, and 11.6.x ≤ 11.6.3 with the Agents plugin's MCP server active in stdio mode. No public exploit code or CISA KEV listing is present in the available data; exploitation is constrained to attackers who already have local access to the stdio MCP interface.

Server-Side Request Forgery in HTMLy 3.1.1 allows authenticated administrators to coerce the server into issuing arbitrary outbound HTTP or local filesystem requests via the RSS feed import feature. The vulnerable `get_feed()` function at `system/admin/admin.php` lines 1549-1551 passes the admin-supplied URL directly to PHP's `file_get_contents()` with no scheme filtering or allowlist validation, enabling access to cloud metadata endpoints (e.g., 169.254.169.254), internal network services, or local files via `file://` wrappers. No public exploit or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 2.1 reflects the high privilege prerequisite and limited confidentiality impact.

Server-side JavaScript execution and outbound HTTP request capabilities in Rapid7 InsightConnect Markdown Plugin versions 3.1.4 and earlier allow remote attackers to execute arbitrary scripts and make unauthorized HTTP requests through malicious content embedded in Markdown input to the markdown_to_pdf action. The PDF rendering engine lacks sufficient restrictions on script execution and network access. Patched version 4.0.0 is available from the vendor.

Server-side request forgery in KubeVirt's virt-api port-forward handler allows authenticated Kubernetes users with kubevirt.io:edit permissions to establish arbitrary bidirectional TCP tunnels from virt-api's trusted cluster-internal network position to any routable destination, bypassing NetworkPolicy isolation. The vulnerability arises because virt-api reads the target IP from vmi.Status.Interfaces[0].IP - a value supplied by the QEMU guest agent inside the VM and thus fully controllable by the VM owner when non-masquerade network bindings (bridge or secondary-only) are in use - and passes it directly to net.Dial() without validation. No public exploit or active exploitation has been identified at time of analysis; EPSS data was not available in the provided intelligence.

JWT algorithm confusion in Netflix Lemur 1.9.0 allows an attacker to control which signing algorithm the server trusts by supplying an arbitrary alg value in the unverified token header, which is passed directly to pyjwt.decode() instead of a server-pinned allowlist. On current PyJWT 2.x deployments the standalone impact is limited to audit-log blinding and a durable algorithm-downgrade primitive; full account takeover requires chaining with a separate LEMUR_TOKEN_SECRET disclosure vulnerability, after which a forged HS256 admin JWT yields HTTP 200 with role=admin. A public proof-of-concept walkthrough exists (asciinema); no active exploitation is confirmed in CISA KEV.

Server-Side Request Forgery in Netflix Lemur's certificate verification pipeline allows an authenticated operator-role user to force the Lemur host to issue outbound HTTP requests to arbitrary internal destinations by uploading a crafted certificate whose CRL Distribution Point or OCSP responder extensions point to RFC1918 addresses, link-local endpoints (169.254.169.254), internal Kubernetes API servers, or loopback interfaces. Both `crl_verify` and `ocsp_verify` in `lemur/certificates/verify.py` pass attacker-controlled URLs directly to network sinks with no destination allow-list, scheme restriction beyond LDAP rejection, or private-address filtering. No public exploit confirmed in CISA KEV, but detailed proof-of-concept reproduction steps are published in the GitHub Security Advisory GHSA-54vg-pfh7-jq95; vendor-released patch v1.9.2 is available.

Server-side request forgery in MaxKB before 2.10.0 allows any authenticated user holding the default workspace USER role to coerce the application server into making arbitrary HTTP requests to attacker-controlled destinations via the `downloadCallbackUrl` and `download_url` parameters on ToolSerializer endpoints. An attacker can pivot through the MaxKB host to probe and extract data from internal network services - cloud metadata APIs, internal databases, adjacent microservices - that would otherwise be inaccessible from outside the network perimeter. A public proof-of-concept exists at GitHub issue #6272; this is not confirmed actively exploited (not in CISA KEV).

Server-side request forgery in NewsBlur's add_url endpoint allows any authenticated user to direct the server to issue arbitrary HTTP requests to private, loopback, or link-local addresses, including cloud instance metadata services. All NewsBlur deployments prior to version 14.5.0 (CPE: cpe:2.3:a:samuelclay:newsblur) are affected. An attacker with a valid account can supply a URL resolving to 169.254.169.254 or other internal addresses, enabling exfiltration of cloud provider IAM credentials and internal network reconnaissance. No public exploit identified at time of analysis, though patch commits are publicly available on GitHub and document the exact missing validation check.

Server-side request forgery in Huly Platform's /import endpoint allows authenticated workspace users to coerce the front pod into making arbitrary HTTP requests to internal infrastructure. Any valid workspace account can supply attacker-controlled URLs; the server fetches them, leaking internal service responses - including cloud metadata credentials - back to the attacker. A publicly available exploit exists per the GitHub issue tracker, though active exploitation has not been confirmed by CISA KEV. The CVSS 4.0 vector assigns SC:H, flagging high confidentiality impact on subsequent (internal) systems as the primary risk.

Server-side request forgery in LibreChat before 0.8.4-rc1 lets any authenticated user point a custom OpenAI-compatible endpoint baseURL at internal network addresses, because the URL is used to build HTTP requests with no SSRF validation whatsoever - no private-IP blocking, no scheme restriction, and no DNS pinning. By abusing the legitimate custom-endpoint feature, a logged-in user can coerce the server into reaching internal-only services and returning their responses, with a CVSS 3.1 score of 7.7 driven by a changed scope and high confidentiality impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the trivial low-complexity nature makes it readily exploitable once an account exists.

NONET network restriction bypass in Nokogiri's JRuby implementation permits external resource fetching during XML Schema parsing despite the default network-blocking parse option being set, exposing applications to potential SSRF and XXE attacks. Only JRuby-based deployments are affected - CRuby users are fully protected because libxml2's xmlNoNetExternalEntityLoader enforces NONET at the I/O layer independently of Nokogiri's option handling. Rated low severity by maintainers (CVSS 2.6); vendor-released patch is available in version 1.19.4, and no public exploit has been identified at time of analysis.

HTML injection into server-side PDF rendering contexts in Pretix enables low-privileged authenticated users to embed external image references that trigger outbound HTTP requests from the rendering engine, leaking the server's network identity and creating an SSRF vector against internal network services. The CVSS 4.0 score of 2.1 reflects genuinely low severity - exploitation requires authentication, specific content reaching PDF rendering paths, and passive user interaction to trigger PDF generation. No public exploit code exists and this vulnerability is absent from CISA KEV.

Server-side request forgery in Appsmith prior to version 2.1 allows authenticated users to reach loopback-bound services inside the deployment container by exploiting a split code path in host validation logic. The WebClientUtils component used by REST API and GraphQL datasource plugins enforces only an exact-match string denylist, while the comprehensive address-class check covering loopback, any-local, link-local, and fc00::/7 IPv6 ranges exists solely on the SMTP plugin code path - leaving the HTTP path bypassable. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Server-side request forgery in Ghost CMS versions 6.19.4 through 6.21.1 allows authenticated staff users to pivot the Ghost server into making arbitrary outbound HTTP requests, including to internal network hosts and cloud instance metadata endpoints. The vulnerable code path is Ghost's post re-rendering pipeline, which fetches image dimensions from URLs stored in image cards without validating those URLs against a trusted host allowlist. No public exploit has been identified at time of analysis, and a vendor-released patch is available in 6.21.1.

Server-Side Request Forgery in Pentestify 1.0.0's PDF generation endpoint enables remote attackers (PR:N per CVSS 4.0 vector) to coerce the server into issuing outbound HTTP requests to arbitrary internal or external targets, including cloud metadata services such as the AWS Instance Metadata Service at 169.254.169.254, by supplying a crafted HTTP Host header. The rendered PDF is returned to the caller, potentially leaking internal service responses or IAM role credentials. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the vulnerability is patched in version 1.1.0.

Server-Side Request Forgery in the WP Meta SEO WordPress plugin (all versions through 4.5.18) enables authenticated contributors to coerce the web server into issuing arbitrary outbound HTTP requests via the `new_link` parameter, with the response status code reflected back through the AJAX JSON response as `status_code`. This status-code oracle allows methodical enumeration of internal network hosts and cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), making it particularly dangerous in cloud-hosted WordPress deployments. No public exploit identified at time of analysis, though the vulnerability is confirmed by Wordfence with direct source code references and the technique is well-understood.

Eager DNS resolution during InetSocketAddress deserialization in jackson-databind (versions 2.0.0 through pre-fix releases across the 2.18, 2.21, and 3.x lines) allows any attacker who can supply untrusted JSON to an affected endpoint to force outbound DNS lookups for attacker-chosen hostnames at readValue() time - before application validation or connect logic can intervene. This DNS-based SSRF (CWE-918) enables internal resolver probing, network topology enumeration, and DNS out-of-band interaction signals against applications that deserialize untrusted JSON into types containing InetSocketAddress fields. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence sources.

Unauthenticated remote action execution in motionEye (pip/motioneye < 0.44.0) exposes every camera action endpoint - snapshots, recording start/stop, and administrator-configured shell scripts - to any attacker who can reach port 8765, due to a missing @BaseHandler.auth() decorator on ActionHandler.post(). Dynamically confirmed on v0.43.1 in a Docker lab environment; exploitation requires only a single HTTP POST with no credentials, headers, or user interaction. Beyond the CVSS 5.3 Medium rating, real-world impact extends to physical security bypass (PTZ, alarms, lighting controls) if action scripts are configured, and SSRF via remote camera triggering - no public exploit or CISA KEV listing is identified at time of analysis.

Server-side request forgery in OpenStack Swift's proxy-server allows authenticated users to manipulate object servers into issuing outbound HTTP requests to attacker-specified hosts. All Swift deployments running version 2.0.0 or later across all maintained release trains are affected, including the 2025.1/epoxy, 2025.2/flamingo, 2026.1/gazpacho, and development 2026.2/hibiscus branches. No public exploit has been identified at time of analysis, but successful exploitation could expose internal infrastructure topology, metadata services, or other resources reachable from the object server tier.

Server-side request forgery in Flowise's Execute Flow node allows authenticated low-privilege users to coerce the server into issuing HTTP requests to arbitrary internal network addresses by supplying intranet URLs through the base URL configuration field. All flowise and flowise-components npm versions through 3.0.13 are affected due to the Execute Flow code path never invoking the secureFetch wrapper present in httpSecurity.ts. Publicly available exploit code exists in GHSA-9hrv-gvrv-6gf2, including a concrete POST request demonstrating server-side retrieval and echo of internal service responses; no CISA KEV listing indicates active mass exploitation at time of analysis.

Server-Side Request Forgery (SSRF) in n8n's dynamic node parameters endpoint allows authenticated users with credential access to bypass the platform's Allowed HTTP Request Domains restriction, causing the n8n server to issue outbound HTTP requests carrying stored credentials to attacker-controlled or unauthorized hosts. All n8n deployments prior to version 2.20.0 are affected regardless of domain restriction configuration, as the restriction is not enforced on the POST /rest/dynamic-node-parameters/options endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is low-complexity once authentication is obtained.

Blind Server-Side Request Forgery in Paymenter's PayPal gateway module (versions < 1.5.0) allows remote unauthenticated attackers to coerce the application server into issuing arbitrary HTTP GET requests by supplying a malicious URL in the PAYPAL-CERT-URL HTTP header. The webhook endpoint at /extensions/paypal/webhook passes this header directly to PHP's file_get_contents() with no allowlist, domain validation, or signature pre-check, violating the security intent of PayPal's certificate verification flow. No public exploit has been identified at time of analysis, but the zero-prerequisite attack surface and public advisory disclosure make this an accessible target for any unauthenticated actor who can reach the endpoint.

Server-Side Request Forgery in OpenAM's /sessionservice endpoint allows authenticated attackers to register arbitrary URLs for session event notifications, causing the IAM server to make outbound HTTP requests to attacker-controlled destinations. Affected versions are org.openidentityplatform.openam:openam-core up to and including 16.0.6; the flaw was patched in release 16.1.1. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication barrier is low (any valid session), and deployment context - a central enterprise authentication gateway - elevates the downstream risk of internal network reconnaissance or session data exfiltration.