CVE-2026-127145

SOGo before 5.12.13 SSRF via Web Calendar Subscriptions

SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Alinto

Products

Sogo

CVE-2026-32591

Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration

A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Mirror Registry Mirror Registry For Red Hat Openshift Quay

CVE-2026-92735

Vault integrated storage join may disclose server environment credentials

HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-91878

XML Injection in Dell OpenManage Ansible Modules

Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the XML data conversion component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to XML injection, malicious content injection, and XML parsing errors

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-95634

CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

C2pa C2pa-web C2patool and 2 more

CVE-2026-17131

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-17117

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improperly controlled modification of object attributes. A user could set a field that should only be controlled by the system, which could lead to code execution.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-110692

PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import

The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Powerpack Addons For Elementor

CVE-2026-118422

Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Stape Conversion Tracking

CVE-2026-125114

Novu: SSRF via conditions filter webhook bypasses validateUrlSsrf() protection

Novu provides an API for sending notifications through multiple channels. Prior to 3.15.0, the conditions filter webhook in libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts passes the user-configured child.webhookUrl directly to axios.post without calling validateUrlSsrf. Evaluating a workflow condition can therefore make the worker send a POST request to a private or link-local service and return the response data for condition evaluation. The response is stored in execution details and exposed through GET /execution-details, which can disclose credentials from POST-capable metadata services or data from internal services, although metadata endpoints that require GET are not reachable through this path. This issue is fixed in version 3.15.0.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Novu

Products

Novu

CVE-2026-125115

Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition

Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address space or its IPv4-mapped IPv6 forms. The workflow HTTP request step and webhook filter condition can therefore send server-side requests when a configured literal address or resolved hostname falls in that range. In Alibaba Cloud, 100.100.100.200 may expose instance metadata, while self-hosted and multi-tenant deployments may expose provider-internal services, private infrastructure, service meshes, or VPN resources reachable through CGNAT addressing. This issue is fixed in version 3.17.0.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Novu

Products

Application-generic Novu

CVE-2026-110289

Git Sync connections send credentials to unvalidated server URLs

A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery).

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Enterprise

CVE-2026-56712

Replicate Cog through 0.23.1 SSRF via cog.File and cog.Path URL Inputs

Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP before fetching. Attackers can supply malicious URLs or exploit HTTP redirects in cog.File and cog.Path predictor inputs to force requests to internal addresses, potentially exposing sensitive internal services or credentials.

CVSS 4.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Replicate

Products

Cog

CVE-2026-118439

Limit Login Attempts Reloaded < 3.4.2 - Admin+ SSRF via App Setup Code

The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF).

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Limit Login Attempts Reloaded

CVE-2026-64473

vfio: Remove device debugfs before releasing devres

In the Linux kernel, the following vulnerability has been resolved: vfio: Remove device debugfs before releasing devres VFIO device debugfs files created with debugfs_create_devm_seqfile() store a devres allocated debugfs_devm_entry as inode private data. vfio_unregister_group_dev() currently calls vfio_device_del() before vfio_device_debugfs_exit(), but device_del() releases devres. This can leave debugfs entries visible with stale inode private data while unregister waits for userspace references to drain. Remove the per-device debugfs tree before vfio_device_del(). The debugfs view is diagnostic only, so losing it at the start of unregister is preferable to preserving entries whose backing storage may already have been released. Complete the teardown by clearing the per-device debugfs root after removal. This matches the global debugfs root cleanup and prevents future users from mistaking a removed dentry for a live debugfs tree during the remainder of unregister.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-64467

rust_binder: use a u64 stride when cleaning up the offsets array

In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array (binder_size_t = u64 entries), cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry read. On 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels it walks the 8-byte entries in 4-byte steps, iterating an N-entry array 2N times, and reads the always-zero high word as offset 0, cleaning up the object at offset 0 N extra times. As a result the referenced node or handle ends up with a lower reference count than it actually has (a refcount over-decrement), and binder's reference accounting is corrupted; for example, the owner can be notified of a strong reference release (BR_RELEASE) even though references still remain. Change the stride to u64, and read each entry as a u64, narrowing it to usize with try_into(). On 32-bit ARM, when this over-decrement would drive a count below zero, the driver's existing refcount guard refuses it and fires: rust_binder: Failure: refcount underflow!

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-117543

Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8

Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when retrieving external download URLs could bypass validation of the original destination. This allowed server-side requests to internal or otherwise prohibited destinations and disclosure of their responses (SSRF).

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-64466

rust_binder: clear freeze listener on node removal

In the Linux kernel, the following vulnerability has been resolved: rust_binder: clear freeze listener on node removal Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this scenario the freeze listener remains in the freeze_listeners rbtree and in the remote node's freeze listener list, even though the ref for which the listener is registered is gone. This could potentially lead to a memory leak due to a refcount cycle. Thus, remove the freeze listener in this scenario.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-106472

Server-side request forgery in the Prometheus data source resource API

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints [missing path allowlist]. A user with permission to query the data source can read responses from other endpoints on that server using the data source's credentials.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123753

Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints

Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault, allowing requests to internal hosts and delivery of response content to a host of the caller's choosing. From 2.0.2, decoupled responses are refused unless allowNonAnonymousResponseEndpoints is enabled, and enabled endpoints are restricted by scheme and screened at both the header-parsing and transport-selection layers. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apache Axis2/java