CVE-2026-62030

WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-27350

WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Builderius.io

Products

Builderius

CVE-2026-103958

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafted connection address supplied when registering, updating or testing a tool server or remote agent. To remediate this issue, users should upgrade to version 1.7.0 or later.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Loom

CVE-2026-103957

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Loom

CVE-2026-107394

Indico: Incomplete Server-Side Request Forgery (SSRF) check

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Indico

Products

Indico

CVE-2026-96890

Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Github

Products

Enterprise Server

CVE-2026-107781

Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Dromara

Products

Skyeye

CVE-2026-97354

PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Powerpress

CVE-2026-106557

Backstage: Improper input validation in TechDocs Markdown extension configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDocs build to access resources outside the intended documentation boundary, potentially exposing backend-host data or internal network resources. This issue is fixed in versions 1.14.6 and 1.15.4 when pymdown-extensions 10.21.3 or later is also used, normally through mkdocs-techdocs-core 1.7.0 or later.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Backstage

Products

Backstage Plugin-techdocs-node

CVE-2026-76286

Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server

In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface (API) tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it to access data and perform actions as the user who ran the tool. Successful exploitation requires a user who holds a role that contains the mcp_tool_execute capability to run a custom API tool configured by another user. For more information see Configure the Splunk MCP Server (https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/1.2/configure-the-splunk-mcp-server) and Managing custom tools in Splunk MCP Server (https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/1.2/managing-custom-tools-in-splunk-mcp-server) in the Splunk documentation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Splunk

Products

Splunk Mcp Server

CVE-2026-105800

i18next-http-backend incomplete URL validation permits SSRF

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

I18next

Products

I18next-http-backend

CVE-2026-101149

Security Advisory 0186

Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2026-101150

Security Advisory 0186

Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2022-44729

Apache XML Graphics Batik: Information disclosure vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Apache Debian Redhat

Products

Xml Graphics Batik Debian Linux Camel Spring Boot and 1 more

CVE-2020-11987

batik: SSRF due to improper input validation by the NodePickerPanel

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.

CVSS 3.1 · 8.2 High EPSS 13.6% KEV · Not listed

Vendors

Apache Debian Fedoraproject and 2 more

Products

Batik Debian Linux Fedora and 20 more

CVE-2026-107698

FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling

FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ffmpeg

Products

Ffmpeg

CVE-2026-67101

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Service Management

CVE-2026-107449

Heimdall SSRF via /test_config Endpoint

linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Linuxserver

Products

Heimdall

CVE-2026-70605

Electron: HTTP redirect followed into local file loader

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Electron Electronjs

Products

Electron Electron

CVE-2026-102105

Kiteworks Email Protection Gateway server-side request forgery

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF) weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal or otherwise unintended network destinations. The requests are triggered while the gateway renders message content that references external resources. Depending on the services reachable from the gateway, this could disclose sensitive internal information or trigger unintended actions on internal systems.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Kiteworks Email Protection Gateway