A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.
Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). This vulnerability allows a high privileged attacker with remote access to potentially cause information disclosure, bypass protection mechanisms, perform SSRF attacks, and gain unauthorized access. The CVSS v3.1 base score is 7.7, indicating high severity. No patch or remediation details are provided in the available data.
The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.
CVE-2026-69435 is a critical Server-Side Request Forgery (SSRF) vulnerability in the Microsoft Azure SRE Agent. It involves missing authorization controls that allow an authorized attacker to elevate privileges over a network. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality and integrity. Microsoft has issued an official fix for this cloud service vulnerability.
CVE-2026-107362 is a server-side request forgery (SSRF) vulnerability in the Malcolm platform's file-upload component, specifically in the bundled FilePond PHP server. Authenticated users can exploit this flaw to make the server fetch arbitrary URLs over HTTP, HTTPS, or FTP and receive the response, potentially exposing internal resources accessible from the upload container. This affects Malcolm versions from 0 up to and including 26.07.1.
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with force_download='allow-local' or web_fetch_tool with allow_local_urls=True can bypass the cloud-metadata blocklist by appending an IPv6 zone identifier to an IPv6 metadata address. IPv6Address equality and hashing include the zone identifier, so the blocklist comparison fails even though the network stack ignores the zone on a non-link-local destination and reaches the metadata service, potentially exposing cloud IAM credentials. The opt-in settings are disabled by default, and the issue requires an IPv6-enabled environment. This issue is fixed in versions 1.107.6 and 2.44.0.
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string, causing the application to fetch that host with its own privileges. allowed_domains fails closed for unmatched spellings, and private-IP and cloud-metadata protections remain effective. This issue is fixed in versions 1.107.6 and 2.44.0.
IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows an authenticated attacker with low privileges to send unauthorized requests from the affected system. The vulnerability could enable network enumeration or assist in other attacks. The CVSS 3.1 base score is 4.9, indicating medium severity. No public exploits or patch information are provided in the available data.
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
CVE-2026-106032 is a server-side request forgery (SSRF) vulnerability in the OpenAPI schema processing of the agent import functionality in Amazon Bedrock AgentCore Starter Toolkit versions 0.1.4 through 0.3.13. An authenticated remote actor within the same AWS account could exploit this flaw to cause the environment of a user importing a Bedrock Agent to make arbitrary outbound requests and read arbitrary local files. The vulnerability is fixed in version 0.3.14. The product is deprecated and users are advised to migrate to the supported replacement @aws/agentcore CLI, which does not contain this issue.
CVE-2026-101150 is a server-side request forgery (SSRF) vulnerability in Arista Networks CloudVision Portal. It results from insufficient validation of OIDC bearer token configuration, enabling users with specific high privileges to direct requests to arbitrary destinations. The vulnerability has a medium severity rating with a CVSS score of 4.1. No known exploits in the wild have been reported. There is no available information on patches or remediation.
CVE-2026-101149 is a server-side request forgery (SSRF) vulnerability in Arista Networks CloudVision Portal. It results from insufficient validation of the OpenID Connect (OIDC) single sign-on provider configuration. A user with specific high privileges could exploit this to send requests to arbitrary destinations. The vulnerability has a medium severity with a CVSS score of 4.1. It affects multiple versions of CloudVision Portal from 2020.3.0 through 2026.1.2 and version 2026.2.0. No known exploits are reported in the wild. No patch or remediation details are currently available.
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.
CVE-2026-105800 is a Server-Side Request Forgery (SSRF) vulnerability in the i18next-http-backend library. It occurs when an attacker controls the language or namespace input that is interpolated into the loadPath template, allowing injection of a colon character that causes the backend to request an unintended origin. This vulnerability affects versions of i18next-http-backend prior to 4.0.2 and was caused by an incomplete patch for a previous related vulnerability. The issue is fixed by rejecting colon characters in language and namespace values and ensuring URLs remain within the intended origin.
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinned_addresses only to the initial destination. The pinned websockets.connect() client follows cross-origin redirects and opens a new TCP connection before Galaxy performs its post-handshake peer-IP validation, allowing WebSocket upgrade requests to internal hosts reachable from the server. The confirmed impact is the internal connection and handshake request, and does not establish arbitrary HTTP methods, response-body disclosure, a completed AIP session, or cloud metadata access. This issue is fixed in version 3.0.9.
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18.
An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply `bytes` values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank sicksec for reporting this issue.