CVE-2026-63441 is a Server-Side Request Forgery (SSRF) vulnerability in Bubka 2FAuth versions 6.1.0 through 7.x prior to 8.0.0. The flaw arises because the URL validation function does not recognize certain NAT64 IPv6 prefixes, allowing crafted otpauth URI image parameters to bypass IP checks and cause the server to fetch internal or private IPv4 addresses via IPv6 translation. This can lead to unauthorized internal network probing or data retrieval via image responses. The issue is fixed in version 8.0.0.
CVE-2026-71495 is a critical server-side request forgery (SSRF) vulnerability in open-wanderer wanderer versions prior to 0.20.0. When the configuration PUBLIC_PRIVATE_INSTANCE is not set to true, unauthenticated attackers can exploit the POST /api/v1/trail/download endpoint by supplying a malicious JSON url field. This causes the server to fetch arbitrary internal network resources, potentially exposing sensitive data or enabling denial of service. The vulnerability is fixed in version 0.20.0.
Kroki versions from 0.26.0 up to but not including 0.31.2 contain a server-side request forgery (SSRF) vulnerability in the Mermaid companion's PNG rendering process. This flaw allows an authenticated actor who can submit Mermaid source diagrams to cause the companion to issue HTTP or HTTPS GET requests without network request restrictions, even when safe mode is enabled. The vulnerability is fixed in version 0.31.2.
CVE-2026-85743 is a server-side request forgery (SSRF) vulnerability in FreeScout versions prior to 1.8.230. Authenticated users with permissions to modify mailbox connection settings or trigger module updates can exploit this flaw to make the server send requests to internal or loopback addresses. This can bypass redirect validation under certain whitelist configurations, allowing attackers to access internal HTTP services and perform blind internal port scans. The vulnerability is fixed in FreeScout version 1.8.230.
CVE-2026-123846 is a server-side request forgery (SSRF) vulnerability in JetBrains IntelliJ IDEA versions before 2026.3. The flaw allows blind SSRF via remote references in JSON Schema validation. It has a CVSS 3.1 base score of 4.3, indicating medium severity. The vulnerability is fixed in version 2026.3.
CVE-2026-123844 is a server-side request forgery (SSRF) vulnerability in JetBrains IntelliJ IDEA versions before 2026.3. The flaw allows SSRF via custom plugin repositories. This vulnerability has a medium severity with a CVSS score of 5.3. It was fixed in version 2026.3.
In Apache James server prior version 3.9.1 improper validation in JMAP webPush SSRF validation did lead to the possibility to reach internal addresses.
Users are recommended to upgrade to version 3.9.1 which fixes this issue.
CVE-2026-123310 is a server-side request forgery (SSRF) vulnerability in JetBrains IntelliJ IDEA affecting versions before 2026.3. Kotlin scripts in untrusted projects could trigger dependency downloads from arbitrary repositories, potentially allowing attackers to induce the IDE to make unintended network requests. The issue is fixed in version 2026.3.
CVE-2026-119431 is a server-side request forgery (SSRF) vulnerability in Foxit Workspace's file-upload functionality. The vulnerability arises from insufficient validation of user-supplied links, which may allow a remote attacker to induce the server to access internal resources. This can lead to sensitive information disclosure and unauthorized access to internal services. The vulnerability has a high severity with a CVSS score of 7.7.
CVE-2026-119433 is a server-side request forgery (SSRF) vulnerability in an undocumented API endpoint of Foxit Workspace. It arises from insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this flaw to make the server send requests to arbitrary internal or external resources, potentially leading to unauthorized access to internal services, network reconnaissance, and disclosure of sensitive information.
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the frontend artifact download path for source=s3 or source=minio accepts providerInfo.Params.endpoint, and the archived pod-log path accepts S3-compatible endpoint metadata from workflow status, without requiring those endpoints to match operator-controlled storage configuration. In the shipped authorization-disabled standalone configuration, an unauthenticated caller can make the shared ml-pipeline-ui pod connect to arbitrary reachable hosts and return response data; requests may also reveal an access-key identifier when signed with configured object-store credentials. Multi-user secret-backed metadata remains restricted to the server namespace. This issue is fixed in version 2.18.0.
CVE-2026-88980 is a server-side request forgery (SSRF) vulnerability in Kubeflow Pipelines prior to version 2.18.0. The flaw exists in the frontend GET /artifacts/get route, which improperly validates URLs allowing unauthenticated or low-privilege users to fetch internal HTTP resources. This can lead to disclosure of cloud credentials if metadata services and roles are reachable. The issue is fixed in version 2.18.0.
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0.
A confused deputy vulnerability (CWE-441) exists in Kubeflow Pipelines prior to version 2.17.0. The API server's pipeline and pipeline-version creation endpoints fetch a user-supplied pipelineURL without restricting the destination, allowing an authenticated user with creation permissions to make requests from the API server to internal services and observe limited status codes. This can lead to information disclosure through a status-code oracle. The issue is fixed in version 2.17.0.
KurrentDB version 26.1.0 contains a vulnerability allowing authorized users with read access to the $all stream and Secondary Indexing query capabilities to read arbitrary files accessible to the database process, enumerate directories, and issue HTTP GET requests from that process. This flaw is limited to users with administrative privileges by default and does not allow file writes or exposure of environment variables. The issue is fixed in version 26.1.1.
CVE-2026-54442 is a server-side request forgery (SSRF) vulnerability in the NationalSecurityAgency's emissary product, a P2P data-driven workflow engine. Versions prior to 8.51.0 improperly validate navigation links by accepting protocol-relative URLs, which browsers may interpret as external origins. This flaw can lead to open redirect, SSRF, and unauthorized cloud metadata access. The vulnerability is fixed in version 8.51.0.
CVE-2026-69137 is a Server-Side Request Forgery (SSRF) vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The vulnerability arises because the CalendarAccount testConnection action passes an authenticated user's server_url directly to curl without validating the host, address, or scheme. This allows an attacker to cause the server to send crafted PROPFIND requests from its network context, potentially accessing internal services, disclosing partial responses, enumerating services, and possibly accessing cloud metadata. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
SuiteCRM versions prior to 7.15.2 and 8.10.2 contain a server-side request forgery (SSRF) vulnerability due to improper hostname validation. The SSRF protection implemented in version 7.15.1 uses substring comparison instead of strict hostname equality, allowing an authenticated attacker to bypass IP validation by placing the server hostname in a URL path. This enables the attacker to direct server-side requests to internal services. The issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-63111 is a missing authorization vulnerability in SuiteCRM's V8 module API prior to versions 7.15.2 and 8.10.2. It allows low-privileged users to create SchedulerJobs with attacker-controlled target values that are executed with system privileges. This can lead to server-side requests to internal or external hosts, potentially exposing internal services. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.