CVE-2026-123125 is a vulnerability in the Symfony Validator component's IpValidator that causes incomplete classification of internal IP addresses in certain filtered modes of the Ip constraint. This flaw allows some internal addresses to be incorrectly accepted as public, potentially enabling Server-Side Request Forgery (SSRF) attacks. The issue affects Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The vulnerability arises because the PHP filter flags used do not cover shared address space or certain IPv6 address types that embed internal IPv4 addresses. Applications relying on this validation to block internal addresses before making server-side requests may be exposed to SSRF.
CVE-2026-115740 is a server-side request forgery (SSRF) vulnerability in Trellix DLP on-prem extensions version 11.13.1 and earlier. The vulnerability arises because the OpenEventEvidenceFile.do endpoint accepts a file Prefix parameter that allows arbitrary UNC paths without validation. This causes the server to resolve hostnames and initiate SMB authentication to attacker-controlled hosts.
CVE-2026-81828 is a Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz versions before 24.09.08. It allows an authenticated back-office user with catalog permission to specify arbitrary URLs as a product-store survey's template location. This causes the server to fetch and render attacker-controlled content, including internal network resources and local files, without validating the URL scheme or host. The malicious content is then rendered into the HTTP response for any shopper loading the affected survey, resulting in non-blind information disclosure. The issue is fixed in version 24.09.08.
Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
NoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. It caches the result per host, and passes the IP to the decorated client through the resolve option so that the client connects to the exact IP that was checked. The issue is that resolve was only passed on the first lookup of a host: on subsequent requests, the decorated client resolved the host again on its own.
An attacker who controls a host's DNS can exploit this with DNS rebinding by answering the first lookup with a public IP, and subsequent lookups with a private IP, so when an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens, for example, when an application fetches several URLs of a repository provided by a user. The check of the primary_ip in the on_progress callback still aborts the request before anything is sent, but the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, as in CVE-2024-50342.
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.
CVE-2026-102337 is a server-side request forgery (SSRF) vulnerability in Webmin versions prior to 2.652. It allows untrusted users with access to the File Manager or Upload and Download modules to make the server perform URL downloads to internal network addresses or cloud metadata endpoints that are not accessible from the user's system. This vulnerability is fixed in Webmin version 2.652.
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10.
A Server-Side Request Forgery (SSRF) vulnerability exists in draw.io versions prior to 30.3.8 in the optional /proxy endpoint. The URL validator does not block requests to the RFC 6598 shared address range 100.64.0.0/10, allowing unauthenticated remote attackers to make the server request internal services within this range. This could lead to disclosure of data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. The issue is fixed in version 30.3.8.
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.
The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.
The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the get-artifacts function. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the server. Was ZDI-CAN-28192.
Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.
Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.
The Tapo
Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability
because it accepts a user-controlled host value without sufficient input
validation. An attacker may exploit this vulnerability to cause the Tapo Cloud
service to send requests to an attacker-controlled server.
Successful
exploitation may cause the Tapo Cloud service to send a request to an
attacker-controlled server, exposing the internal information and causing
potential Distributed Denial-of-Service (DDoS).
A Server-Side Request Forgery (SSRF) vulnerability exists in Django versions 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The issue arises from the django.contrib.gis.gdal.SpatialReference component, which does not restrict GDAL's file and network access when parsing spatial reference strings. This allows attackers to induce server-side requests or read local files via crafted input. Earlier unsupported Django versions may also be affected. The vulnerability has a medium severity score of 5.3 and has been fixed in the specified versions.
A Server-Side Request Forgery (SSRF) vulnerability exists in Django versions prior to 6.1.3, 6.0.10, and 5.2.19 in the django.contrib.gis.gdal.OGRGeometry module. This flaw allows remote attackers to cause the server to make requests to attacker-controlled destinations via crafted GeoJSON coordinate reference system (crs) members. The issue affects multiple supported Django versions and was reported by the Submersion Security Research Team.
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.