CVE-2026-81207 is a Server-Side Request Forgery (SSRF) vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. An authenticated tenant without project membership or role can fully control the scheme, host, port, and path of an outbound fetch request from a shared-infrastructure pod. The vulnerability allows reflection of the WSDL body verbatim to the caller. The affected component runs on an OpenShift overlay with access to co-tenant services, in-cluster CP4D APIs, and link-local addresses. The vulnerability impacts confidentiality with high severity and integrity with low severity, with no impact on availability.
IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a server-side request forgery (SSRF) vulnerability due to improper validation of user-supplied URLs. This flaw could allow a remote attacker to access sensitive information from internal network resources. The vulnerability has a high severity rating with a CVSS score of 8.6. No official patch or remediation details are provided in the available data.
CVE-2026-81265 is a Server-Side Request Forgery (SSRF) vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.5. It allows an unauthenticated attacker to induce the server to make HTTP requests to arbitrary domains. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with high confidentiality impact but no integrity or availability impact.
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery (SSRF) vulnerability.
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints.
A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.
CVE-2026-89049 is a critical server-side request forgery (SSRF) vulnerability in Amazon AWS Systems Manager Agent (SSM Agent) versions before 3.3.4851.0. It arises from improper validation of equivalent address representations in the port forwarding functionality, allowing an authenticated remote user to bypass the remote destination denylist and access link-local endpoints. This can lead to unauthorized retrieval of temporary IAM role credentials from a managed instance, enabling actions with those permissions from outside the instance. The issue is fixed in version 3.3.4851.0 and later.
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
CVE-2026-57866 is a Server-Side Request Forgery (SSRF) vulnerability in Apache Impala versions 4.4.0 through 4.5.1. Authenticated users with permission to execute the ai_generate_text() function can exploit this flaw to exfiltrate secrets from credential providers configured in the hadoop.security.credential.provider.path property. The attacker must know the secret's key to retrieve the secret. This vulnerability has a high severity rating with a CVSS score of 8.8.
Apache Impala versions 2.0.0 through 4.5.1 contain a server-side request forgery (SSRF) vulnerability. This flaw allows an attacker to specify a table property with an avro.schema.url pointing to an HTTP or file URI, causing Impala to issue GET requests to internal endpoints. The responses may be exposed through parsing error messages. The issue is fixed in version 4.5.2.
A Server-Side Request Forgery (SSRF) vulnerability exists in Yordam Informatics Technology Consulting's Library Information and Document Automation Program versions before 22.2. This vulnerability allows an attacker to induce the server to make unintended requests. The flaw has a CVSS 3.1 base score of 5.3, indicating medium severity. The issue is fixed in version 22.2.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restrictions for normal calls but not for the model-search dropdown. A workflow editor could set options.baseURL to an arbitrary host and make the searchModels path send the openAiApi credential there. The affected implementation is packages/@n8n/nodes-langchain/nodes/llms/LMChatOpenAi/methods/loadModels.ts, which omitted assertOpenAiCredentialAllowsUrl. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
CVE-2026-66304 is a server-side request forgery (SSRF) vulnerability in Microsoft Skype for Business Server 2015 CU13. It allows an unauthorized attacker to disclose information over a network without requiring user interaction. The vulnerability affects specific versions prior to fixed releases and has a high severity rating with a CVSS score of 7.5. An official fix is available from Microsoft.
A Server-Side Request Forgery (SSRF) vulnerability exists in the n8n workflow automation platform prior to versions 2.37.7 and 2.38.2. The issue occurs in the Instance AI credential setup flow, where a credential test or verification URL is accepted without verifying that it matches the workflow node's origin. This allows attacker-controlled content to influence the URL, potentially causing authenticated requests, redirects, or probes to unintended origins. The vulnerability affects specific code handling credential URLs and is fixed in versions 2.37.7 and 2.38.2.
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.
CVE-2026-69904 is a server-side request forgery (SSRF) vulnerability in Microsoft SharePoint Server Subscription Edition. It allows an authorized attacker to disclose information over a network. The vulnerability affects versions 16.0.0 up to but not including 16.0.20326.20082. A patch is available and has been officially released by Microsoft.
CVE-2026-81357 is a high-severity server-side request forgery (SSRF) vulnerability in Microsoft Visual Studio Code. It allows an unauthorized attacker to bypass a security feature over a network. The vulnerability affects Visual Studio Code versions from 1.0.0 up to but not including 1.136.2. An official fix is available in version 1.136.2.