Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,278

Export CSV
CVE-2026-110255

Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint

Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Finsys
Products
Dockhand
CVE-2026-108554

PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input

PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Pdfmathtranslate
Products
Pdfmathtranslate
CVE-2026-88206

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-70202

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-70251

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Sharepoint Server
CVE-2026-108787

houtini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery

A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collect_corpus. Performing a manipulation of the argument sitemap_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Houtini-ai
Products
Voice-analyser-mcp
CVE-2026-108572

Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.0 is able to address this issue. The name of the patch is 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9/ada08ecd10cbf158f593dee23a8bab63efecf995. It is advisable to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Casdoor
Products
Casdoor
CVE-2026-108521

Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration."

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Studio-saelix
Products
Sencho
CVE-2026-108836

Ollama Pull API name.go IsValid server-side request forgery

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.34.2 is sufficient to fix this issue. The identifier of the patch is dfabde4539e42ba1e1eab50a3a50b88aea7958a0. It is suggested to upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ollama
Products
Ollama
CVE-2026-109378

SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url

SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects without re-validating targets with valider_url_distante(). Authenticated attackers can supply a remote URL, such as a syndicated site feed or remote document, that redirects to internal or link-local addresses including cloud metadata endpoints.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spip
Products
Spip
CVE-2026-104636

Gitea SSRF through Git HTTP redirects in mirrors and fetches

Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository administrator using a policy-allowed endpoint that redirects could make Gitea's Git client send requests to an address that the outbound host policy would otherwise block. The impact depends on the configured policy and the internal services reachable from the server.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-109239

Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch

Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass Docker server egress controls. Attackers can enable check_robots_txt and use redirects or DNS rebinding to reach internal, loopback, or cloud-metadata addresses for service discovery.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Unclecode
Products
Crawl4ai
CVE-2026-70357

Gitea repository migration SSRF through DNS rebinding

Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control the destination's DNS can change the address between validation and connection to reach a blocked internal address. The affected path is the Git clone operation; validation in the migration HTTP client's dialer does not protect the independently connecting Git subprocess.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-89430

Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a repository, which includes repositories they create themselves, could aim push mirror synchronization at internal Git services and force-push the repository's contents to them.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-78027

Server‑Side Request Forgery in Dell Secure Connect Gateway Policy Manager Versions Prior to 5.34.00.16

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager
CVE-2026-78024

Server‑Side Request Forgery in Dell Secure Connect Gateway Policy Manager

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, Server-side request forgery, and Unauthorized access.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager
CVE-2026-57143

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_url parameter directly to requests.get without validating its scheme, host, port, or resolved address. Prompt-injected content can direct the default search tool to internal JSON services, distinguish open and closed internal ports, and attempt cloud-metadata requests, with returned JSON results entering agent context. This issue is fixed in praisonaiagents 1.6.62.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mervinpraison
Products
Praisonaiagents
CVE-2026-109238

Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling link_preview_config on /crawl requests. Attackers can supply a controlled page with include_external and include_patterns set, causing AsyncUrlSeeder to fetch internal, private, and cloud-metadata links and return their parsed head data.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Unclecode
Products
Crawl4ai
CVE-2026-96400

Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS

With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-network block list did not cover these ranges, and a hostname matching the allow list was accepted regardless of its resolved address. A user who can start migrations on such an instance could reach these addresses from the Gitea server; the default empty `ALLOWED_DOMAINS` configuration is not affected.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea