CVE-2026-71366 is a server-side request forgery (SSRF) vulnerability in multiple AWX notification backends of Red Hat Ansible Automation Platform 2.5 for RHEL 8. Notification backends including webhook, Mattermost, Rocket.Chat, and Grafana use notification template URLs as direct HTTP request targets without validating against private, loopback, or reserved IP ranges. This allows an organization notification administrator to cause the AWX control node to make HTTP requests to internal or loopback addresses. The webhook backend also follows HTTP redirects and resends Basic Authentication credentials to redirected hosts without host validation, risking credential exfiltration. The Grafana backend sends its API key in the Authorization header to the configured URL. No complete mitigation exists except applying the forthcoming update; interim mitigations include restricting notification template creation to trusted admins and network egress filtering.
CVE-2026-78277 is a Server-Side Request Forgery (SSRF) vulnerability affecting WP ManageNinja LLC's FluentCRM Pro plugin versions up to and including 3.1.12. The flaw allows an attacker with low privileges to induce the server to make unauthorized requests, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity with a CVSS score of 4.9. No patch or remediation details are provided in the available data.
CVE-2026-78269 is a Server-Side Request Forgery (SSRF) vulnerability affecting Tammersoft Shared Files versions up to 1.7.69. The vulnerability allows an attacker with low privileges to induce the server to make unauthorized requests. It has a medium severity with a CVSS score of 6.4. No patch or remediation information is currently provided.
Mailgun for WordPress plugin versions up to and including 2.2.0 contain a critical Server-Side Request Forgery (SSRF) vulnerability due to insufficient input validation in the add_list() function. This flaw allows unauthenticated attackers to leverage the WordPress site's Mailgun API key to send authenticated POST requests to any Mailgun API endpoint. Exploitation can lead to creation of inbound email-forwarding routes, enabling interception of password reset emails and potential administrator account takeover.
CVE-2026-47735 is a path traversal vulnerability in Basekick-Labs' Arc time-series database prior to version 26.06.1. The vulnerability arises because Arc's user-SQL validator only blocked certain DuckDB I/O functions via regex denylist, leaving many others unblocked. This allowed unauthorized file access through scalar table functions in SQL queries. The issue is fixed in version 26.06.1 by implementing a structural sandbox at the DuckDB layer that restricts file access to an allowlist and disables further extension installs or loads.
CVE-2026-53509 is a server-side request forgery (SSRF) vulnerability in ondata's ckan-mcp-server versions prior to 0.4.106. The vulnerability arises because the server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string, missing certain hostname aliases like 'ip6-localhost' that resolve to loopback addresses. This allows remote attackers who can invoke CKAN tools with a server_url parameter to make the server connect to local or private network addresses and potentially receive data from those internal endpoints. The issue was fixed in version 0.4.106 by expanding the blocked hostname checks to include these aliases.
SpecifyJS versions prior to 0.2.136 contain a Server-Side Request Forgery (SSRF) vulnerability due to improper handling of URL parsing errors. The function assertSecureUrl failed to throw an error when new URL() parsing failed, allowing requests to bypass HTTPS validation. This issue is fixed starting from version 0.2.136, where the catch block correctly throws an error to prevent insecure requests.
CVE-2026-69502 is a critical server-side request forgery (SSRF) vulnerability in Microsoft Azure SQL Database. It allows an unauthorized attacker to elevate privileges over a network. The vulnerability has a CVSS score of 10.0, indicating critical severity. Microsoft has issued an official fix for this cloud service vulnerability.
CVE-2026-13176 is a Server-Side Request Forgery (SSRF) vulnerability in the Eventin WordPress plugin versions before 4.1.21. It allows users with contributor-level access or higher to trigger blind server-side requests to arbitrary hosts by exploiting insufficient validation of user-supplied webhook URLs and lack of event ownership verification.
CVE-2026-50112 is a high-severity OS command injection vulnerability in Apache CloudStack affecting versions from 4.14.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. An authenticated tenant can exploit this by registering a VM template with a malicious metalink file, leading to remote code execution as root on the KVM hypervisor host. The issue arises because inner URLs in metalink XML files are not properly validated against allowed schemes. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-59085 is a critical Server-Side Request Forgery (SSRF) vulnerability in the webhook module of Apache CloudStack. It affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability allows unauthenticated attackers to send crafted webhook delivery requests that could lead to unauthorized information disclosure and impact confidentiality and integrity. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-61422 is an authenticated server-side request forgery (SSRF) vulnerability in Apache CloudStack affecting template and ISO registration. The vulnerability occurs because CloudStack makes a live HTTP HEAD/GET request to determine file size before validating the URL. However, URL validation is still performed before the actual download, reducing the risk of malicious template or ISO registration. The issue affects versions 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later resolves the vulnerability.
CVE-2026-77648 is a server-side request forgery (SSRF) vulnerability in OpenStack Glance affecting versions 30.0.0 through 32.0.0. It occurs in the /v2/tasks API when handling import tasks, allowing an admin user to fetch internal URLs within the Glance service network. This API is restricted to admin users and has been deprecated for several releases. The vulnerability has a low CVSS score of 2.2 and results in limited information disclosure without impacting confidentiality, integrity, or availability beyond that.
CVE-2026-77646 is a high-severity vulnerability in PTC Windchill PDMLink and PTC FlexPLM involving deserialization of untrusted data that can lead to Server-Side Request Forgery (SSRF). This vulnerability allows an attacker to exploit the system without authentication, potentially causing unauthorized requests from the server. Multiple specific versions of Windchill PDMLink are affected. No patch or official remediation details are provided in the available data.
CVE-2026-72846 is a Server-Side Request Forgery (SSRF) vulnerability in Lightdash that allows an authenticated user with permission to create or trigger scheduled deliveries to cause the server to send POST requests to arbitrary internal or private network addresses. This occurs because webhook URLs are stored and later fetched without proper server-side validation, bypassing protections against accessing internal or cloud metadata endpoints. The vulnerability can be used to probe internal network services by observing error behaviors, though the response content is not returned to the attacker but logged on the server. Version 1.146.4 introduced a change routing webhook calls through a validation utility, but earlier versions are affected.
CVE-2026-69855 is a server-side request forgery (SSRF) vulnerability in Microsoft Copilot in Azure that allows an authorized attacker to disclose information over a network. The vulnerability has a high severity score of 7.7 and affects the cloud-hosted Microsoft Copilot service. Microsoft has issued an official fix for this vulnerability.
CVE-2026-69543 is a server-side request forgery (SSRF) vulnerability in Microsoft Azure Virtual Machines. It allows an authorized attacker to elevate privileges over a network. The vulnerability has a high severity with a CVSS score of 8.5. Microsoft has issued an official fix for this vulnerability. The service is cloud-hosted, and Microsoft manages the remediation for this issue.
CVE-2026-66800 is a server-side request forgery (SSRF) vulnerability in Microsoft Azure Data Factory. This flaw allows an unauthorized attacker to cause the service to disclose information over a network. The vulnerability has a high severity with a CVSS score of 8.6. Microsoft has issued an official fix for this vulnerability and manages remediation for this cloud-hosted service.
CVE-2026-54508 is a Server-Side Request Forgery (SSRF) vulnerability in mauriceboe TREK, a collaborative travel planner. Versions prior to 3.1.0 improperly validate URLs during certain list import and URL resolution functions, allowing authenticated users to cause the server to make blind GET requests to internal or sensitive network addresses without revalidation. This could enable access to internal services such as loopback, RFC 1918 private addresses, or cloud metadata endpoints. The issue is fixed in version 3.1.0.
CVE-2026-69851 is a critical server-side request forgery (SSRF) vulnerability in Microsoft Entra (Azure Active Directory). It allows an authorized attacker to elevate privileges over a network, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS score of 9.9, indicating severe impact. Microsoft has issued an official fix for this cloud service vulnerability.