Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,279

Export CSV
CVE-2026-56779

MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters

MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download_url parameters. Attackers with default workspace USER role can exploit this to access internal network services by providing malicious URLs to the ToolSerializer endpoints.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
1panel Maxkb
Products
Maxkb Maxkb
CVE-2026-49139

Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning

Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfiltrate Bot Framework bearer tokens by supplying a forged activity with an attacker-controlled serviceUrl value. Attackers can poison the stored conversation reference by sending a crafted inbound activity to the Teams webhook, causing subsequent bot replies to transmit token-bearing Authorization header requests to an attacker-controlled host.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Hkuds Nanobot
Products
Nanobot Nanobot
CVE-2026-49138

Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following

Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows remote attackers to reach internal or private network hosts by supplying a URL that redirects to a loopback or private address via a 3xx Location header. Attackers can exploit the automatic HTTP redirect following behavior in the httpx library to bypass initial URL validation and cause the runtime to send outbound requests to internal hosts before final resolved URL validation is applied.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hkuds Nanobot
Products
Nanobot Nanobot
CVE-2026-49129

Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin

Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set without CURLOPT_REDIR_PROTOCOLS_STR, allowing unauthenticated attackers to bypass the http/https scheme restriction by causing a malicious HTTP server to redirect to non-HTTP protocols such as gopher, ftp, sftp, ldap, dict, rtmp, or rtsp. Attackers can trigger this vulnerability via MPD commands that initiate URL fetches, including add, readcomments, albumart, readpicture, or load, to interact with internal or restricted network services on systems running libcurl versions prior to 7.85.0.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Musicpd Musicplayerdaemon
Products
Music Player Daemon Mpd
CVE-2026-48555

Spatie Laravel Media Library < 11.23.0 SSRF via addMediaFromUrl()

Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Spatie
Products
Laravel Media Library
CVE-2026-34428

Vvveb < 1.0.8.1 SSRF via oEmbedProxy

Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2023-7325

Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF

Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix socket RPC endpoints and perform privileged XML-RPC methods. An attacker able to send such requests can invoke administrative RPC methods via the unix socket interface to create arbitrary user accounts on the system, resulting in account creation and potential takeover of the bastion host. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:17.837319 UTC.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Anheng Information Kubernetes
Products
Mingyu Operations And Maintenance Audit And Risk Control System Operations
CVE-2026-65923

Potential server-side request forgery in Artifactory Ansible repository handling

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Jfrog
Products
Artifactory
CVE-2026-65057

Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck

Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a malicious host parameter to cause the backend to issue outbound requests to internal services or cloud metadata endpoints, enabling theft of cloud credentials and internal network reconnaissance.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Keep Project Keephq
Products
Keep Keep
CVE-2026-63744

SurrealDB before 3.1.5 SSRF via JWKS URL Redirect

SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, bypassing network access controls.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63743

SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed because the port information is dropped during redirect policy evaluation.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63736

SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution

SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists without checking resolved IP addresses. An Owner role attacker can point an access method at an allow-listed hostname resolving to private or loopback addresses, causing the server to issue GET requests to internal addresses that would be blocked by direct URL.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Surrealdb
Products
Surrealdb
CVE-2026-63107

LimeSurvey SSRF via REST API Survey Template Host Header

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Limesurvey
Products
Limesurvey
CVE-2026-56167

Azure AI Search Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Ai Search Azure Ai Search
CVE-2026-47695

CC-Tweaked has an SSRF Protection Bypass with NAT64

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.request`, `http.websocket`) blocks requests to private network ranges to prevent server-side request forgery (SSRF). This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses (`64:ff9b::/96`). An attacker who can execute Lua code can reach any internal IPv4 service that the filter is intended to block, by addressing it as `http://[64:ff9b::<ipv4-as-hex>]/` instead of its direct IPv4 address. This affects any CC-Tweaked deployment on a network with NAT64 routing — a configuration that is standard on AWS, GCP, and other cloud platforms when using IPv6-only subnets. Version 1.119.0 fixes the issue.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tweaked
Products
Cc-tweaked
CVE-2026-65558

WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpcenter
Products
Wordpress Affiliatex
CVE-2026-17192

VeloCloud Orchestrator Missing Input Validation SSRF

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Arista Networks
Products
Velocloud Orchestrator On-prem