Total
4031 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-65618 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 6.5 MEDIUM |
| Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data. | |||||
| CVE-2026-24639 | 2026-10-24 | N/A | 4.4 MEDIUM | ||
| Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions. | |||||
| CVE-2026-43910 | 1 Appium | 1 Java-client | 2026-10-24 | N/A | 8.2 HIGH |
| Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directConnectHost, directConnectPort, and directConnectPath fields from the server's NEW_SESSION response and rebuilds the client's server URL from them, validating only that the protocol is https, with no host allowlist or IP validation; a rogue or compromised server can therefore redirect all subsequent session traffic to an arbitrary destination, enabling full interception of session traffic and a server-side request forgery pivot to internal hosts, including cloud metadata (IMDS) credential theft. This vulnerability is fixed in 10.1.1. | |||||
| CVE-2026-9081 | 1 Langflow | 1 Langflow | 2026-10-24 | N/A | 7.1 HIGH |
| IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges (loopback, RFC1918, link-local addresses). | |||||
| CVE-2026-57106 | 1 Microsoft | 1 Purview Data Governance | 2026-10-24 | N/A | 10.0 CRITICAL |
| Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-48051 | 2026-10-24 | N/A | 3.5 LOW | ||
| Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses — loopback, link-local, and RFC-1918 ranges. The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist. An attacker registers a webhook pointing to an attacker-controlled server, which redirects incoming POSTs to any internal address. Exploitation was confirmed by live test against the official Docker image. The fix is a single-line change to the webhook HTTP client. This issue has been patched in version 26.5.0. | |||||
| CVE-2026-76239 | 2026-10-24 | N/A | 6.3 MEDIUM | ||
| Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-side HTTP POST requests to internal services, enabling blind SSRF attacks against localhost and private network endpoints. | |||||
| CVE-2026-56167 | 1 Microsoft | 1 Azure Ai Search | 2026-10-24 | N/A | 8.5 HIGH |
| Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-64649 | 1 Vercel | 1 Next.js | 2026-10-24 | N/A | 6.5 MEDIUM |
| Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11. | |||||
| CVE-2026-67428 | 2026-10-24 | N/A | 8.5 HIGH | ||
| Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, HTTP-emitting modules including src/core/modules/third_party/developer/http/requests.py, core.api.http_get, core.api.http_post, graphql.query, graphql.mutation, monitor.http_check, communication.slack_send, notification.discord.send_message, notification.slack.send_message, notification.teams.send_message, ai.vision_analyze, verify.visual_diff, browser.proxy_rotate, and the agent and llm inline base_url branch fetch caller-controlled URLs without validate_url_with_env_config, allowing SSRF to internal or metadata endpoints. This issue is fixed in version 2.26.7. | |||||
| CVE-2026-65925 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 6.5 MEDIUM |
| A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. | |||||
| CVE-2026-65442 | 2026-10-24 | N/A | 7.2 HIGH | ||
| Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions. | |||||
| CVE-2026-21653 | 2026-10-24 | N/A | N/A | ||
| Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application server: from 2.9 through 3.0. | |||||
| CVE-2026-17534 | 2026-10-24 | N/A | 5.5 MEDIUM | ||
| Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call (for example via prompt injection) can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode. | |||||
| CVE-2026-64799 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder. | |||||
| CVE-2026-34981 | 1 Pavelzbornik | 1 Whisperx Rest Api | 2026-10-24 | N/A | 5.8 MEDIUM |
| The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated. This vulnerability is fixed in 0.6.0. | |||||
| CVE-2026-62201 | 1 Openclaw | 1 Openclaw | 2026-10-24 | N/A | 7.7 HIGH |
| OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal network destinations blocked by OpenClaw policy. Attackers can send HTTP requests through the exec-server to access network resources that should have been restricted by configured policies. | |||||
| CVE-2026-61953 | 2026-10-24 | N/A | 7.2 HIGH | ||
| Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions. | |||||
| CVE-2026-66437 | 2026-10-24 | N/A | 4.9 MEDIUM | ||
| Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions. | |||||
| CVE-2026-17192 | 2026-10-24 | N/A | 8.5 HIGH | ||
| A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks. | |||||