CVE-2026-106498 | High | 7.7 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is… |
CVE-2026-106459 | High | 8.5 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affect… |
CVE-2026-106455 | High | 7.7 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by… |
CVE-2026-106032 | Medium | 5.7 | 2026-10-06 | Server-side request forgery in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit before 0.3.14 might… |
CVE-2026-96400 | | | 2026-10-06 | With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link… |
CVE-2026-89430 | | | 2026-10-06 | Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed t… |
CVE-2026-70357 | | | 2026-10-06 | Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves th… |
CVE-2026-104636 | | | 2026-10-06 | Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations… |
CVE-2026-101150 | Medium | 4.1 | 2026-10-06 | Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations. |
CVE-2026-101149 | Medium | 4.1 | 2026-10-06 | Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations. |
CVE-2026-101029 | | | 2026-10-06 | Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was va… |
CVE-2026-96890 | | | 2026-10-06 | A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to i… |
CVE-2026-105800 | Low | 3.7 | 2026-10-06 | i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled langua… |
CVE-2026-87890 | Medium | 5.3 | 2026-10-06 | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
An incomplete fix for CVE-2026-15307 in Django spatial lookups all… |
CVE-2026-105790 | Medium | 6.4 | 2026-10-06 | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /a… |
CVE-2026-39728 | High | 7.2 | 2026-10-06 | Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions. |
CVE-2026-39719 | High | 7.2 | 2026-10-06 | Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions. |
CVE-2026-105762 | High | 8.3 | 2026-10-06 | Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py acce… |
CVE-2026-105743 | Medium | 4.0 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, valid… |
CVE-2026-103546 | Medium | 4.3 | 2026-10-05 | In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager backup configuration may allow a user who can modify an OpsManager custom resourc… |
CVE-2026-105438 | Medium | 4.3 | 2026-10-05 | A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/wi… |
CVE-2026-95265 | High | 7.5 | 2026-10-05 | Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopba… |
CVE-2026-105689 | | | 2026-10-05 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not cla… |
CVE-2026-105682 | Low | 2.7 | 2026-10-05 | Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hos… |
CVE-2026-105648 | Medium | 4.0 | 2026-10-05 | Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an u… |
CVE-2026-105647 | Medium | 4.0 | 2026-10-05 | Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an… |
CVE-2026-105636 | Critical | 9.9 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() with… |
CVE-2026-105628 | High | 7.6 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a… |
CVE-2026-104977 | High | 7.7 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shippe… |
CVE-2026-104976 | | | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to p… |
CVE-2026-104973 | High | 7.6 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in… |
CVE-2026-86671 | | | 2026-10-05 | In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher… |
CVE-2026-12171 | High | 7.8 | 2026-10-05 | auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into i… |
CVE-2026-102777 | | | 2026-10-05 | Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the… |
CVE-2026-92931 | High | 8.8 | 2026-10-05 | CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attack… |
CVE-2026-63269 | | | 2026-10-05 | LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that mad… |
CVE-2026-63267 | | | 2026-10-05 | LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded… |
CVE-2026-105290 | High | 7.3 | 2026-10-05 | A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.p… |
CVE-2026-105263 | Medium | 4.7 | 2026-10-05 | A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/a… |
CVE-2026-105238 | High | 7.3 | 2026-10-05 | A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the compone… |
CVE-2026-105301 | Medium | 4.0 | 2026-10-05 | A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is… |
CVE-2026-105214 | | | 2026-10-04 | Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organiza… |
CVE-2026-105148 | High | 7.3 | 2026-10-04 | A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component… |
CVE-2026-105122 | Medium | 5.4 | 2026-10-03 | OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make OpenAM fet… |
CVE-2026-82044 | High | 7.7 | 2026-10-02 | UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal… |
CVE-2026-82040 | Medium | 5.0 | 2026-10-02 | UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl() that allows authenticated attacke… |
CVE-2026-103958 | High | 7.6 | 2026-10-02 | Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to ob… |
CVE-2026-103957 | Medium | 6.2 | 2026-10-02 | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token o… |
CVE-2020-37278 | High | 7.5 | 2026-10-02 | Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supp… |
CVE-2026-94483 | Medium | 6.5 | 2026-10-02 | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resoluti… |
CVE-2026-102797 | Medium | 6.4 | 2026-10-02 | Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Ad… |
CVE-2026-104470 | Medium | 5.0 | 2026-10-02 | YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url paramete… |
CVE-2026-104464 | High | 8.6 | 2026-10-02 | YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying a… |
CVE-2026-104463 | High | 7.0 | 2026-10-02 | YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Fo… |
CVE-2026-104459 | Medium | 6.5 | 2026-10-02 | YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests t… |
CVE-2026-104458 | Medium | 6.5 | 2026-10-02 | YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard… |
CVE-2026-104442 | Medium | 5.8 | 2026-10-02 | YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs… |
CVE-2026-104441 | Medium | 5.3 | 2026-10-02 | YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary host… |
CVE-2026-104440 | Medium | 5.3 | 2026-10-02 | YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests vi… |
CVE-2026-80464 | Medium | 4.9 | 2026-10-02 | Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery.
This issue affects Sef - AI Ch… |
CVE-2026-104120 | High | 7.3 | 2026-10-02 | A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetch_ur… |
CVE-2026-56661 | High | 7.5 | 2026-10-01 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches… |
CVE-2026-56660 | Critical | 9.1 | 2026-10-01 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in Upda… |
CVE-2026-100251 | Medium | 6.5 | 2026-10-01 | Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated att… |
CVE-2026-55232 | High | 7.6 | 2026-10-01 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a… |
CVE-2026-103757 | High | 7.7 | 2026-10-01 | Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table generation because the uploadUrl function in packages/server/src/utili… |
CVE-2026-103291 | Medium | 6.4 | 2026-10-01 | Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff user… |
CVE-2026-103287 | Low | 2.7 | 2026-10-01 | Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts… |
CVE-2026-103082 | High | 7.2 | 2026-10-01 | Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This… |
CVE-2026-103497 | Medium | 5.5 | 2026-10-01 | In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration |
CVE-2026-103542 | Medium | 4.3 | 2026-10-01 | A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the component AJAX E… |
CVE-2026-103530 | High | 7.3 | 2026-10-01 | A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the compo… |
CVE-2026-102138 | Low | 3.3 | 2026-09-30 | An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved with… |
CVE-2026-102105 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102104 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102103 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102102 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in K… |
CVE-2026-102095 | Critical | 9.1 | 2026-09-30 | Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side… |
CVE-2026-102091 | High | 7.5 | 2026-09-30 | Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the… |
CVE-2023-54402 | High | 7.5 | 2026-09-30 | iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs… |
CVE-2026-101883 | Medium | 5.4 | 2026-09-30 | OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation… |
CVE-2026-62308 | Critical | 9.1 | 2026-09-30 | Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make the backend… |
CVE-2026-55177 | | | 2026-09-30 | CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI help… |
CVE-2026-100279 | Medium | 6.5 | 2026-09-30 | In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials |
CVE-2026-100257 | Medium | 4.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export |
CVE-2026-103243 | Medium | 5.8 | 2026-09-30 | LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side… |
CVE-2026-102983 | | | 2026-09-30 | Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN… |
CVE-2026-102577 | Medium | 4.3 | 2026-09-30 | A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote use… |
CVE-2026-97316 | Medium | 5.8 | 2026-09-30 | The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attack… |
CVE-2026-102904 | Medium | 5.4 | 2026-09-29 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5… |
CVE-2026-76728 | High | 7.2 | 2026-09-29 | A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side… |
CVE-2026-102879 | Medium | 5.0 | 2026-09-29 | ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download_file and scrape_web agent tools. Authenticated users can bypa… |
CVE-2026-102877 | Medium | 4.4 | 2026-09-29 | Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth… |
CVE-2026-100297 | Medium | 5.3 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s inter… |
CVE-2026-102722 | | | 2026-09-29 | In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values… |
CVE-2026-92222 | High | 8.0 | 2026-09-29 | Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improper… |
CVE-2026-102244 | Medium | 4.3 | 2026-09-29 | A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsense_backend/app/routes/editor_routes… |
CVE-2026-102267 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated… |
CVE-2026-55160 | High | 7.6 | 2026-09-28 | Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authent… |
CVE-2026-101913 | | | 2026-09-28 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts rec… |