CVE-2026-65801 is a critical server-side request forgery (SSRF) vulnerability in Microsoft Exchange Online. It allows an unauthorized attacker to elevate privileges over a network, potentially leading to full compromise of confidentiality, integrity, and availability. An official fix is available from Microsoft.
CVE-2026-71428 is an open redirect vulnerability in the unstructured library versions from 0.4.7 up to but not including 0.24.0. The library's functions partition, partition_html, and partition_md fetch URLs without validating the host, allowing attackers controlling the URL to induce server-side requests to internal or cloud metadata endpoints. This can lead to disclosure of internal responses and potentially trigger side-effecting GET endpoints. The vulnerability is fixed in version 0.24.0.
CVE-2026-65842 is a Server-Side Request Forgery (SSRF) vulnerability in the udecode plate rich-text editor prior to version 53.3.2. The vulnerability arises from the @platejs/docx-io component fetching remote image URLs during HTML to DOCX conversion in server-side or privileged environments. This allows attackers to make requests to internal network resources and include the fetched image data in generated DOCX files, potentially disclosing internal responses and causing resource consumption. The issue is fixed in version 53.3.2.
CVE-2026-61704 is a Server-Side Request Forgery (SSRF) vulnerability in the OP-Engineering link-preview-js library prior to version 4.0.4. The issue arises from a DNS rebinding attack where the mitigation logic validates a resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to bypass SSRF protections. This can lead to unauthorized server-side requests to internal HTTP resources. The vulnerability also affects redirect handling due to the same validation-to-fetch mismatch. The issue is fixed in version 4.0.4.
CVE-2026-63044 is a Server-Side Request Forgery (SSRF) vulnerability in Apache InLong that allows any authenticated user, without requiring admin privileges, to make the InLong Manager server send outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This affects Apache InLong versions from 2.0.0 up to but not including 2.4.0. The issue is addressed in version 2.4.0 and can also be mitigated by applying the referenced patch from the Apache InLong GitHub repository.
ATutor version 2.2.4 contains a Server-Side Request Forgery (SSRF) vulnerability in its import functionalities. An authenticated administrator can exploit this flaw to make the server perform arbitrary HTTP requests to internal endpoints, cloud metadata services, or access local files via file:// if PHP URL wrappers are enabled. The product is no longer actively supported, and no fixes have been released for this vulnerability.
Koel versions prior to 9.7.1 contain a Server-Side Request Forgery (SSRF) vulnerability in their podcast and radio fetch functionality. The application performs initial checks on outbound URLs but does not consistently validate redirect targets or revalidate after DNS rebinding, allowing an authenticated user to cause the server to make requests to internal or cloud metadata services. This could lead to unauthorized access to internal resources or sensitive data. The issue is fixed in version 9.7.1.
Koel versions prior to 9.7.0 contain a server-side request forgery (SSRF) vulnerability in the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes. These routes accept an authenticated user's streamUrl without proper validation, allowing the server to fetch arbitrary URLs. This can expose internal HTTP services accessible from the Koel server. The vulnerability is fixed in version 9.7.0.
Koel versions prior to 9.7.1 contain a server-side request forgery (SSRF) vulnerability due to improper handling of certain IPv6 address wrappers in the isPublicHost() function. An authenticated user can exploit this by placing a crafted URL in a podcast RSS enclosure, causing the application to fetch internal or cloud metadata services and return the response. This vulnerability is fixed in version 9.7.1.
Koel versions prior to 9.7.0 contain a server-side request forgery (SSRF) vulnerability in the Subsonic-compatible createPodcastChannel.view route. This flaw allows an authenticated user to supply a private URL that bypasses SafeUrl validation, leading the server to make unintended HTTP requests to internal network addresses. The vulnerability is fixed in version 9.7.0.
CVE-2026-53549 is a Server-Side Request Forgery (SSRF) vulnerability in Termix, a web-based server management platform. Versions prior to 2.3.2 have an issue in the POST /host/db/proxy/test endpoint where certain request fields are not validated for destination addresses. This allows an authenticated user to make raw TCP and SOCKS connections to arbitrary hosts and ports accessible from the Termix server, including localhost and private network resources. Exploitation can disclose host reachability, timing information, and potentially expose cloud credentials via metadata services. The vulnerability is fixed in version 2.3.2.
CVE-2026-68558 is a Server-Side Request Forgery (SSRF) vulnerability in Wekan, an open source kanban application built with Meteor. Versions from 8.36 up to but not including 9.74 contain an issue where the outgoing webhook Integration URL validator only checked the hostname against regex patterns, allowing certain DNS names to bypass initial validation. This led to inconsistent enforcement of IP address blocking between input-time and connection-time validation. The vulnerability is fixed in version 9.74 by enhancing address resolution and validation logic to cover all resolved addresses, pin connections, and block redirects.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster. This enables unauthorized access to internal services that would otherwise be protected, potentially leading to information disclosure or further compromise of the cluster environment.
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.
Gotenberg versions 8.32.0 and earlier contain a vulnerability in the IsPublicIP function that fails to reject certain IPv6 transition prefixes, allowing crafted DNS AAAA records to bypass private IP restrictions. This can enable unauthenticated attackers to access internal cloud metadata services and potentially expose cloud credentials via the Chromium URL conversion route. The issue requires specific network configurations such as dual-stack or NAT64-enabled environments. The vulnerability is fixed in version 8.33.0.
An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the OpenShift Console Dev Console webhook helpers in Red Hat OpenShift Container Platform 4.18.53. This flaw allows user-supplied URLs to be fetched server-side without proper validation, enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position. The vulnerability has a high severity rating and affects on-premise or private cloud deployments of OpenShift Container Platform 4.18.53. Mitigation involves applying NetworkPolicy egress restrictions to limit outbound connectivity from the console pod to only required endpoints. Users are advised to upgrade to the updated packages and images provided in this advisory.
Dell OpenManage Enterprise versions prior to 4.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-54794). This vulnerability allows an unauthenticated remote attacker to potentially cause information exposure. The vulnerability has a high severity rating with a CVSS score of 7.2. No patch or remediation details are provided in the available data.
CVE-2026-76239 is a server-side request forgery (SSRF) vulnerability in eidetic-labs stigmem-node versions before 0.9.0a11. The flaw arises because the delivery_address parameter used when creating webhook subscriptions is not properly validated. Authenticated users can exploit this to make the server send HTTP POST requests to internal loopback and private network addresses, enabling blind SSRF attacks.