CWE-918: Server-Side Request Forgery vulnerabilities

A Server-Side Request Forgery (SSRF) vulnerability exists in Next.js versions 16.0.0 through 16.3.7 in the Image Optimization feature when using images.remotePatterns. This allows attacker-controlled DNS resolution to bypass allow-list checks and fetch images from private IP addresses. Applications not using images.remotePatterns are not affected. The issue is fixed in version 16.3.8.

CVE-2026-80464 is a Server-Side Request Forgery (SSRF) vulnerability in HAVELSAN Inc.'s Sef - AI Chatbot Platform versions before 2.1. This vulnerability allows an attacker with high privileges to induce the server to make unauthorized requests. The issue is fixed in version 2.1. The product is no longer supported by the vendor.

Wormhole.app versions prior to 2026-08-22 contain a Server-Side Request Forgery (SSRF) vulnerability due to misconfiguration of the coturn TURN server. This flaw allows unauthenticated attackers to access instance metadata or initiate TCP connections from the Wormhole relay's IP address. The vulnerability has a medium severity with a CVSS score of 6.5.

Vvveb CMS versions prior to 1.0.8.6 contain a Server-Side Request Forgery (SSRF) vulnerability. The SSRF guard only resolves IPv4 addresses and does not inspect IPv6 addresses, allowing authenticated admin users to bypass private-range checks using IPv6 literals or domains with only AAAA records. This enables reading of internal-only services and cloud metadata, including IAM credentials. The issue is patched in version 1.0.8.6.

In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration

Kiteworks Email Protection Gateway versions prior to 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote, unauthenticated attacker to cause the gateway to send crafted requests to internal or unintended network destinations when rendering message content with external resource references. Exploitation could lead to disclosure of sensitive internal information or unintended actions on internal systems.

Kiteworks Email Protection Gateway versions prior to 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote, unauthenticated attacker to cause the gateway to send crafted requests to internal or unintended network destinations during an online certificate status check for inbound messages. Exploitation could lead to disclosure of sensitive internal information or disruption of gateway operations.

Kiteworks Email Protection Gateway versions before 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote, unauthenticated attacker to cause the gateway to send crafted requests to internal or unintended network destinations when retrieving a certificate revocation list from inbound messages. Exploitation could lead to disclosure of sensitive internal information or disruption of gateway operations.

Kiteworks Email Protection Gateway versions before 9.5.0 contain a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows a remote, unauthenticated attacker to cause the gateway to send crafted requests to internal or unintended network destinations when processing inbound messages. Exploitation could lead to disclosure of sensitive internal information or disruption of the gateway's operation. The vulnerability has a high severity with a CVSS score of 9.1.

CVE-2026-102138 is a server-side request forgery (SSRF) vulnerability in Kiteworks Core. It affects versions prior to 9.5.1 and requires an authenticated administrator on a node with the licensed gateway role enabled. The vulnerability allows the administrator to supply a connector URL that the server retrieves without sufficient validation, potentially causing requests to internal network services. The CVSS score is low (3.3), reflecting limited impact and high attack complexity.

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote, unauthenticated sender could craft a message that caused the gateway to issue requests to internal services and cloud instance metadata endpoints and return the responses, potentially disclosing sensitive internal data and, depending on the internal service reached, affecting its state.

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.

CVE-2026-62308 is a critical server-side request forgery (SSRF) vulnerability in Quenary's Tugtainer, a self-hosted app for automating Docker container updates. Versions prior to 1.30.6 allow authenticated users to make the backend server send HTTP requests to arbitrary URLs via the /settings/test_notification endpoint. This endpoint does not restrict protocols, hostnames, localhost, private IP ranges, or cloud metadata addresses, enabling blind SSRF attacks. The vulnerability has been patched in version 1.30.6.

CVE-2026-55177 is a Server-Side Request Forgery (SSRF) vulnerability in dfpc-coe CloudTAK prior to version 13.10.0. Authenticated users with any token can exploit this flaw to make the CloudTAK server send arbitrary HTTP requests to internal network addresses without validation. This allows attackers to access sensitive internal services such as cloud instance metadata endpoints and loopback admin ports, potentially exposing temporary IAM credentials and other internal data. The vulnerability is fully patched in version 13.10.0.

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials

In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin appearing only in a source URL's path or query can satisfy image.domains or image.remotePatterns while the URL's actual host remains attacker-controlled. An unauthenticated request to the public /.netlify/images endpoint can therefore cause the Image CDN to request attacker-selected URLs and may probe or reach internal services. Netlify egress protections may constrain reachable targets, and image transformation limits direct response exfiltration; no confidentiality or integrity impact has been demonstrated. This issue is fixed in version 8.2.4.

CVE-2026-97316 is a server-side request forgery (SSRF) vulnerability in the Broken Link Notifier WordPress plugin versions from 1.3.1 up to but not including 2.0.0.1. The plugin fails to re-validate redirect destinations when checking links, allowing unauthenticated attackers to bypass internal address filters and cause the server to send requests to internal services.

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries.