CWE-918: Server-Side Request Forgery vulnerabilities

CVE-2026-69683 is a server-side request forgery (SSRF) vulnerability in Microsoft SharePoint Server Subscription Edition. It allows an authorized attacker to disclose information over a network. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20082. A fix is available in version 16.0.20326.20082. The CVSS v3.1 base score is 6.5, indicating a medium severity impact primarily on confidentiality.

CVE-2026-69361 is a server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 23. It allows an authorized attacker to perform network spoofing. The vulnerability affects specific versions prior to fixed releases. A patch is available from Microsoft.

CVE-2026-84282 is a Server-Side Request Forgery (SSRF) vulnerability in the ONLYOFFICE ownCloud Integration plugin version 9.12. It occurs because the /apps/onlyoffice/ajax/settings/address endpoint does not properly validate the Document Server URL provided by an authenticated administrator. This flaw allows the ownCloud server to send arbitrary requests to attacker-controlled destinations, including internal network hosts, enabling internal network reconnaissance and TCP port scanning.

In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery (SSRF) to read responses from internal network addresses, including the cloud instance metadata service (169.254.169.254), loopback interfaces, RFC-1918 private ranges, and in-cluster Kubernetes services. The operator-configured allowlist (spec.devEnvironments.allowedSources.urls) is not consulted. The vulnerability is fixed in version 7.122.0, which adds private-address blocking, IPv4-mapped IPv6 bypass prevention, operator allowlist enforcement, and disables HTTP redirects on the outbound request.

Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.

CVE-2026-76971 is a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence version 15.5. It allows an attacker with limited privileges and requiring user interaction to cause the server to make arbitrary outbound requests. This behavior can be combined with XML/XSL processing to execute scripts. The impact on confidentiality, integrity, and availability is considered low. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity.

CVE-2026-82757 is a Server-Side Request Forgery (SSRF) vulnerability in ash-project's ash_authentication_oauth2_server affecting versions from 0.3.0 up to but not including 0.3.1. The vulnerability arises because the server incorrectly classifies certain IPv6 address ranges as publicly routable, allowing an attacker controlling a client metadata URL and its DNS to cause the server to connect to internal or loopback addresses. This could enable unauthorized internal network access via SSRF.

CVE-2026-86503 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.2.2 where opening an untrusted project could trigger a Server-Side Request Forgery (SSRF) via Kubernetes spec-source URL fetching. The vulnerability has a low severity with a CVSS score of 3.3. It requires user interaction and local access to exploit. No known exploits are reported in the wild. The affected versions are all versions prior to 2026.2.2.

The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oembed_thumbnail_resolution()` function using `wp_remote_get()` instead of `wp_safe_remote_get()` to fetch a remote image URL, which does not restrict requests to private or reserved IP ranges. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application server. The response body is not returned to the attacker (blind SSRF), but two oracles exist: a status oracle (the returned URL string differs depending on whether the target responded with HTTP 200) and a timing oracle (response time varies by target reachability).

The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.

Camaleon CMS versions 2.7.5 through 2.9.1 contain a server-side request forgery (SSRF) vulnerability in the 'Upload from URL' media feature. The vulnerability arises because the application fails to properly validate redirect targets when fetching remote files, allowing authenticated users to supply URLs that redirect to internal network addresses. This can lead to unauthorized internal network requests initiated by the server.

A missing authorization vulnerability in forgekeep nebula-mesh versions 0.6.0 through before 0.7.2 allows non-admin users to enable an unguarded HTTP client by setting the allow_private field on their webhook subscriptions. This bypasses internal SSRF protections and lets low-privilege operators make server requests to internal addresses. The issue is patched in version 0.7.2.

IBM Langflow OSS versions 1.0.0 through 1.10.2 contain a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not allow integrity or availability impact but can disclose information. The CVSS score is 5.0 (medium severity). No patch or official fix information is provided in the available data.

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.