CVE-2026-78500 is a medium severity vulnerability in WatchGuard Dimension version 2.0. It is a blind server-side request forgery (SSRF) issue in the Database Server Test configuration that allows an authenticated privileged attacker to enumerate network services on adjacent systems.
CVE-2026-59291 is a low severity vulnerability in Spring Cloud Function that involves a potential server-side request forgery (SSRF) and arbitrary file read. It affects specific versions of Spring Cloud Function including 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. The vulnerability has a CVSS score of 2.0, indicating low impact. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.
A Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-75871) was found in the GitLab AI Gateway component affecting multiple versions from 18.10 through 19.2.2. This flaw allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to attacker-controlled endpoints by manipulating the HTTP Host header in inline flow configurations. Exploitation could lead to disclosure of sensitive Google Cloud Vertex service credentials and private signing keys. The vulnerability has a high severity score of 8.2 and affects the cloud-hosted GitLab AI Gateway service. GitLab has remediated this issue in their cloud environment.
A Server-Side Request Forgery (SSRF) vulnerability exists in the GitLab AI Gateway component affecting multiple versions from 18.9.0 through 19.2.2. An authenticated user with Duo Agent Platform access could exploit this flaw to redirect model requests to attacker-controlled endpoints, potentially exposing Google Vertex AI or AWS Bedrock cloud service credentials. The vulnerability has a high severity score of 8.2 and affects cloud-hosted services.
CVE-2026-59278 is a Server-Side Request Forgery (SSRF) vulnerability in Spring for Apache Kafka. The issue arises because JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. This default configuration allows an external Kafka producer to inject a java.net.InetAddress type via the spring_json_header_types message header. The vulnerability affects multiple versions of Spring for Apache Kafka, including 4.1.0, 4.0.0 through 4.0.6, 3.0.0 through 3.3.16, 2.9.0 through 2.9.14, and 2.8.12 and earlier. The CVSS score is 6.5, indicating a medium severity level.
CVE-2026-47879 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in Spring Cloud Gateway's JsonToGrpcGatewayFilterFactory. It allows attackers with high privileges to specify arbitrary Spring Resource locations for proto descriptor definitions, potentially leading to complete confidentiality and integrity compromise. The vulnerability affects multiple versions of Spring Cloud Gateway up to 5.0.2 and earlier. No official patch or remediation guidance is currently available.
CVE-2026-47861 is a server-side request forgery (SSRF) vulnerability in Spring Integration's UDP inbound adapter. An unauthenticated remote attacker can send a single UDP packet to trigger the server to send an outbound UDP datagram to an arbitrary host and port chosen by the attacker. This affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The vulnerability has a CVSS score of 6.3, indicating a medium severity level. No official patch or remediation information is currently available.
HCL Connections contains a server-side request forgery (SSRF) vulnerability that may allow an attacker with limited privileges and user interaction to send unauthorized requests from the server. This could lead to limited information disclosure or security bypass in certain scenarios. The vulnerability has a low CVSS score of 3.7 and no known exploits in the wild. No patch or official remediation guidance is currently available.
CVE-2026-77573 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in Weblate versions prior to 2026.8. It allows a user with permission to manage component repository URLs to perform server-side request forgery (SSRF) against internal services via DNS rebinding during version control system (VCS) operations. The vulnerability arises because Weblate validates the hostname's initial DNS resolution but the external VCS clients perform a separate DNS lookup later, enabling an attacker-controlled hostname to be redirected to internal or private addresses. This can lead to unauthorized access to internal VCS-compatible services and potential exposure of private repository contents. The issue affects installations that allow untrusted repository hostnames while using the VCS_RESTRICT_PRIVATE=True setting. The vulnerability is fixed in Weblate version 2026.8.
Dell Cloud Disaster Recovery versions 20.2 and prior contain a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-71172). This vulnerability allows a low privileged attacker with remote access to potentially perform SSRF attacks. The CVSS score is 4.3, indicating a medium severity risk. No official remediation or patch information is currently available.
Compliance-trestle versions before 3.12.4 and from 4.0.0 up to 4.0.3 contain a vulnerability in the URLSecurityValidator that allows bypassing its blocklist for certain IP address formats. This enables attackers to cause the tool to fetch resources from restricted internal network endpoints, including loopback, link-local, cloud metadata, and local services. The issue is fixed in versions 3.12.4 and 4.1.0.
Adobe Campaign Classic contains a Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability has a critical severity with a CVSS score of 10, indicating high impact on confidentiality, integrity, and availability. No affected versions or patch information are currently provided.
CVE-2026-70548 is a server-side request forgery (SSRF) vulnerability in JFrog Artifactory that allows a low-privileged user to make requests to remote CocoaPods repositories under specific conditions. The vulnerability does not impact confidentiality or integrity but may cause availability issues. It affects specific versions of Artifactory. The severity is rated low with a CVSS score of 3.5. No known exploits are reported in the wild, and no patch information is currently provided.
CVE-2026-70551 is a high severity server-side request forgery (SSRF) vulnerability in JFrog Artifactory. It allows a user with read access to an existing remote VCS repository to replace its configured origin or supply an absolute VCS data URL, potentially leading to unauthorized access to internal resources or data leakage. The vulnerability affects specific versions of Artifactory, including 7.146.0 and 7.161.0. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-55535 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in MervinPraison's PraisonAI multi-agent teams system. Prior to version 4.6.58, the Jobs API's validate_webhook_url() function fails open on socket.gaierror and does not bind the validated address to the subsequent request. This allows an attacker to supply a webhook_url that later resolves to internal addresses such as 127.0.0.1 or 169.254.169.254. The issue is fixed in version 4.6.58.
CVE-2026-55537 is a high-severity TOCTOU race condition vulnerability in MervinPraison PraisonAI prior to version 4.6.58. The issue arises because JobSubmitRequest.validate_webhook_url() improperly accepts webhook URLs when DNS resolution raises a socket.gaierror exception, which it silently passes. Later, JobExecutor._send_webhook() performs a fresh DNS lookup, allowing an attacker to redirect requests to internal services by changing DNS responses between the two checks. This vulnerability is fixed in PraisonAI version 4.6.58.
CVE-2026-55526 is a vulnerability in MervinPraison's PraisonAI multi-agent teams system. Prior to version 1.6.58, the function spider_tools._host_is_blocked() does not properly resolve hostnames before fetching pages, allowing specially crafted hostnames like 127.0.0.1.nip.io to bypass validation and access internal HTTP services. This reliance on reverse DNS resolution for security-critical actions can lead to unauthorized internal network access. The issue is fixed in PraisonAI version 1.6.58 by using socket.getaddrinfo and failing closed on DNS errors.
CVE-2026-55525 is a Server-Side Request Forgery (SSRF) vulnerability in MervinPraison PraisonAI, a multi-agent teams system. The vulnerability exists because the web_crawl function only validates the initial URL, but does not revalidate redirect targets when following redirects. This allows an attacker who can influence the crawl target to redirect requests to internal resources such as loopback addresses, private networks, or cloud metadata services, even when ALLOW_LOCAL_CRAWL is disabled. The internal response is then returned to the agent context. This issue is fixed in PraisonAI version 1.6.58.
CVE-2026-55976 is a critical Server-Side Request Forgery (SSRF) vulnerability in Apache Hive before version 4.2.1. It allows an authenticated user with CREATE TABLE privileges to cause the Hive server to fetch attacker-controlled URLs during Avro schema resolution. This can lead to exposure of cloud instance metadata, internal network services, or local server files accessible by the Hive process identity. The vulnerability requires network access to HiveServer2 or Metastore and valid Hive authentication but does not require admin privileges. Users are advised to upgrade to Apache Hive 4.2.1, which addresses this issue.
CVE-2026-77310 is a Server-Side Request Forgery (SSRF) vulnerability in the jackson-databind library's deserialization of java.net.InetAddress. Unlike the previously fixed InetSocketAddress deserialization which avoids DNS resolution, the InetAddress deserialization still performs eager DNS lookups on attacker-controlled input. This can lead to DNS-based SSRF allowing out-of-band interaction or internal host enumeration via DNS queries during JSON deserialization.