Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,279

Export CSV
CVE-2026-19927

OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openboxes
Products
Openboxes
CVE-2026-59867

Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.29.1 and 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.

CVSS 3.1 · 7.1 High EPSS 2.4% KEV · Not listed
Vendors
Microsoft
Products
Kiota
CVE-2026-75006

Insufficient CSS Sanitization in Roundcube Webmail Enables SSRF and Information Disclosure

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Roundcube
Products
Webmail
CVE-2026-58612

PowerShell Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Powershell
CVE-2026-49478

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-59765

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58441

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-73629

Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses

Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate address formats to request internal services and retrieve response bodies through the public uploads directory.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
S9y
Products
Serendipity
CVE-2026-73845

CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools in src/tools/quality.ts use isValidMqaServer to validate the server_url parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host and URL-userinfo values to target an attacker-controlled host and return a spoofed response. This issue is fixed in version 0.4.112.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ondata
Products
Ckan-mcp-server
CVE-2026-23603

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-72855

Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing access to blocked internal HTTP services.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Budibase
Products
Budibase Server
CVE-2026-72777

Next AI Draw.io 0.4.16 SSRF via DNS Rebinding in parse-url

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Dayuanjiang
Products
Next-ai-draw-io Next Ai Draw.io
CVE-2026-66415

Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Leantime
Products
Leantime
CVE-2026-59702

repomix - Server-Side Request Forgery via Unvalidated Repository URLs in POST /api/pack

repomix contains a server-side request forgery vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Repomix Yamadashy
Products
Repomix Repomix
CVE-2026-57862

Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation

Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in user-controlled URLs. Attackers can submit hexadecimal-encoded internal IP addresses through the web link creation feature, causing cURL to resolve and connect to internal network resources such as cloud instance metadata services, localhost services, and RFC1918 addresses while the isPrivateURL() filter in app/Core/Http/Client.php incorrectly treats the input as safe due to FILTER_VALIDATE_IP rejecting non-dotted-decimal notation.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Kanboard
Products
Kanboard
CVE-2026-34966

Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea