CVE-2026-110812 is a critical vulnerability in the Amazon Neptune engine's Gremlin graph data import component. It involves deserialization of untrusted data, which could allow an authenticated remote user with standard database permissions to execute arbitrary code and access internal service credentials. The issue affects versions from 1.2.0.0 up to but not including 1.5.0.0. AWS has released a fixed version 1.5.0.0 and backported fixes to 1.4.8.1 and 1.4.7.1. Users not enrolled in auto-update should upgrade to these versions to remediate the vulnerability.
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.
CVE-2026-18660 is a high-severity vulnerability in Eclipse Jetty's jetty-server and jetty-proxy components where the host whitelist/blacklist filtering is case-sensitive. This allows hosts that differ only by case to bypass the intended restrictions.
CVE-2026-39989 is a server-side request forgery (SSRF) vulnerability in QNAP Systems Inc. Download Station. A remote attacker with a user account can exploit this flaw to read application data. The vulnerability has been fixed in Download Station versions 5.10.1.312 and later, and 5.11.2.321 and later. The CVSS 4.0 base score is 5.3, indicating a medium severity level.
PhastPress, a WordPress plugin by kiboit, is affected by a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 3.10. The vulnerability arises because the scripts service endpoint dynamically constructs its URL whitelist from the HTTP 'Host' header, which can be manipulated by unauthenticated attackers. This allows attackers to bypass the whitelist and force the server to make HTTP requests to arbitrary internal or external destinations, potentially exposing response content.
CVE-2026-0311 is a server-side request forgery (SSRF) vulnerability in Palo Alto Networks Checkov by Prisma Cloud. It allows a local unauthenticated user to make unauthorized network requests from the host to internal services. The vulnerability affects versions from 0 up to but not including 3.2.533. The CVSS 4.0 base score is 1.1, indicating low severity. There are no known exploits in the wild and no vendor-provided patch information is available at this time.
InvoiceShelf versions prior to 2.4.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the PDF generation feature. The application validates the gotenberg_host URL only syntactically, allowing an attacker with owner-level privileges to cause the server to send HTTP requests to internal or cloud metadata endpoints. This can expose sensitive customer and company data to an external host. The vulnerability is fixed in version 2.4.0.
CVE-2026-102354 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in BentoPDF versions prior to 2.8.7. The issue arises from a DNS-over-HTTPS safety check performed separately from the outbound fetch, allowing an attacker controlling authoritative DNS to potentially bypass hostname resolution checks under specific conditions. Exploitation requires precise timing and network conditions, and the vulnerability is fixed in version 2.8.7.
A Server-Side Request Forgery (SSRF) vulnerability exists in flytohub flyto-core versions prior to 2.26.3. The flaw arises because the URL validation functions do not properly handle IPv4-mapped, IPv4-compatible, 6to4, or NAT64 transition addresses, allowing an authenticated workflow author to bypass restrictions and cause the server to make requests to internal or cloud metadata services. This can lead to disclosure of sensitive internal data or cloud credentials. The issue is fixed in version 2.26.3.
A Server-Side Request Forgery (SSRF) vulnerability exists in redash versions from 10.0.0 up to but not including 26.9.0. The JSON data source query runner improperly combines a configured base URL with a user-supplied query URL, allowing an absolute URL to override the base URL. This enables users with execute_query permission to make server-side requests to arbitrary external origins. If HTTP Basic Authentication is configured, credentials may be forwarded to these external origins. Private IP blocking can be enforced via REDASH_ENFORCE_PRIVATE_IP_BLOCK. The issue is fixed in version 26.9.0.
KEDA versions 2.20.2 and earlier contain a critical improper privilege management vulnerability. A namespace administrator can exploit this by creating TriggerAuthentication and ScaledObject resources that cause KEDA to send the operator pod's ServiceAccount token to a malicious Vault endpoint. This allows the attacker to gain the operator's cluster-wide permissions, including broad secret access and workload control. The issue is fixed in version 2.21.0.
CVE-2026-85345 is a Server-Side Request Forgery (SSRF) vulnerability in the FV Flowplayer Video Player WordPress plugin versions from 7.5.44.7212 up to but not including 7.5.55.7212. It allows users with Contributor-level access or higher to cause the server to perform HTTP requests to internal resources. The vulnerability arises because the plugin does not properly validate user-supplied URLs and the existing host-based restrictions are incomplete. The impact is limited to revealing whether an internal resource responds and its HTTP status code; the contents of the resource are not disclosed to the attacker.
CVE-2026-95634 is a Server-Side Request Forgery (SSRF) vulnerability in Adobe Content Credentials Rust SDK that can lead to privilege escalation without requiring user interaction. The vulnerability changes the security scope and has a high severity rating with a CVSS score of 8.6. There is no information about available patches or vendor advisories confirming remediation status.
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-34633) that allows a low-privileged attacker to escalate privileges by making unauthorized internal requests. Exploitation does not require user interaction and affects versions up to 2025.0.13 and 2023.0.25. The vulnerability changes the security scope and can lead to high confidentiality impact without affecting integrity or availability.
Adobe ColdFusion 2025 contains a critical Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-106622) that allows an attacker to escalate privileges without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and can lead to full confidentiality, integrity, and availability compromise.
Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-34634) that can lead to privilege escalation without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component. The CVSS score is 8.6, reflecting a high severity issue with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability impacts are none.
Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-76001) that allows a low-privileged attacker to potentially escalate privileges by accessing internal resources. The vulnerability does not require user interaction but depends on conditions outside the attacker's control. It affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and has a high severity rating.