CVE-2026-44430 is a Server-Side Request Forgery (SSRF) vulnerability in the modelcontextprotocol (MCP) registry versions prior to 1.7.7. The vulnerability arises because the registry's HTTP-based namespace verification uses a blocklist that does not cover certain IPv6 address ranges (6to4, NAT64, and deprecated site-local), which can encode arbitrary IPv4 addresses. This allows an attacker to bypass restrictions intended to prevent dialing private or internal addresses, potentially enabling SSRF attacks. The issue is fixed in version 1.7.7.
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation.register_manual() validates the discovery URL against an HTTPS / loopback allowlist, but call_tool() and call_tool_streaming() reuse the resolved tool_call_template.url directly without revalidating, and the OpenAPI converter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g.servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the OpenAPI converter then produces tools whose URL points at internal services on the agent host. All three HTTP-class protocols (utcp_http.http, utcp_http.streamable_http, utcp_http.sse) shared the same gap. This vulnerability is fixed in 1.1.3.
Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.2.5 to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete. It has an incomplete IPv6 prefix list and is missing redirect re-validation. This vulnerability is fixed in 6.4.9.
Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the URLInputHandler class in docling_graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no IP-level validation. Additionally, requests.head() was called with allow_redirects=True, allowing an attacker to redirect requests to internal endpoints via an intermediary URL. An attacker who can control the --source CLI argument or PipelineConfig.source API parameter can trigger Server-Side Request Forgery (SSRF). This vulnerability is fixed in 1.5.1.
Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-beta.1, Nextcloud News allows authenticated users to add feeds by providing a feed URL (via the web interface or the API). In affected versions, an authenticated attacker could provide a URL pointing to internal/private IP ranges or localhost, causing the Nextcloud server to perform server-side HTTP requests to attacker-controlled destinations, but not relaying the result. This enables blind SSRF, which can be used to scan or probe internal network services that are reachable from the Nextcloud server. This vulnerability is fixed in 28.3.0-beta.1.
MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.
The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.1.2 via the popup_submit. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could abuse browser-side redirection mechanisms, such as window.location.href, to make the capture process open file:// URLs or request resources hosted on private, loopback, link-local, or otherwise non-public IP addresses. In deployments where PlaywrightCapture processes untrusted URLs, this could allow a remote attacker to perform server-side request forgery against internal services or attempt to access local files from the capture environment. Depending on what capture artifacts are generated and exposed, responses from those resources could potentially be leaked through screenshots, saved page content, logs, or other capture outputs. This vulnerability is fixed in 1.39.6.
ERPNext versions prior to 15.106.0 and 16.16.0 contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). A malicious user with limited privileges could send a crafted request causing the server to make HTTP calls to arbitrary services. This vulnerability has a CVSS score of 5.0 (medium severity) and is fixed in versions 15.106.0 and 16.
The ftpcp() function in Lib/ftplib.py was not updated when
CVE-2021-4189 was fixed. While makepasv() was patched to replace
server-supplied PASV host addresses with the actual peer address
(getpeername()[0]), ftpcp() still calls parse227() directly and passes
the raw attacker-controllable IP address and port to target.sendport(). This patch is related to CVE-2021-4189.
MISP misp-modules versions prior to 3.0.7 contain vulnerabilities related to improper certificate validation and unsafe remote resource fetching. Specifically, the html_to_markdown module allowed Server-Side Request Forgery (SSRF) via arbitrary HTTP(S) URLs without sufficient validation, potentially targeting internal network resources. The qrcode module disabled TLS certificate verification when retrieving remote images, exposing requests to man-in-the-middle attacks. These issues were addressed in version 3.0.7 by enforcing URL scheme validation, blocking local/private addresses, resolving hostnames before fetching, enforcing request timeouts, and re-enabling TLS certificate verification.
A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition.
Panorama, Cloud NGFW and Prisma® Access are not impacted by these vulnerabilities.
Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.
Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL and then sending API requests with the X-Node-ID header. The Proxy middleware forwards these requests to the attacker-specified internal address, bypassing network segmentation and enabling access to services bound to localhost or internal networks.
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVE-2026-42175 is a Server-Side Request Forgery (SSRF) vulnerability in the requests-hardened library used by saleor. The vulnerability arises because the SSRF protection in requests-hardened versions prior to 1.2.1 does not block IP addresses within the RFC 6598 Shared Address Space (100.64.0.0/10). This allows an attacker who can supply arbitrary URLs to potentially access internal services hosted within this IP range. This is particularly relevant in environments like AWS EKS where this CIDR range is commonly used for internal pod networking. The vulnerability is fixed in version 1.
CVE-2026-43929 is a high-severity vulnerability in the felippe-regazio ssrfcheck library versions 1.3.0 and earlier. The library fails to block Server-Side Request Forgery (SSRF) attacks when private IP addresses are encoded as IPv4-mapped IPv6 addresses. This occurs because the Node.js WHATWG URL parser normalizes IPv4 addresses inside brackets to compressed hex form, which the library's regex does not detect. As a result, all seven IANA private IPv4 ranges, including cloud metadata IPs, are bypassed. Applications relying on isSSRFSafeURL() for SSRF protection are fully exposed to SSRF attacks. A patch is available, and the vendor manages remediation for this cloud-hosted service.
CVE-2026-42141 is a Server-Side Request Forgery (SSRF) vulnerability in the Xibo CMS digital signage platform prior to version 4.4.1. Authenticated users with Library upload permissions can exploit this flaw to make arbitrary HTTP requests from the CMS server to internal or external network resources. This can lead to scanning internal infrastructure, accessing cloud metadata endpoints such as AWS IMDS, interacting with unauthenticated internal services, or exfiltrating data. The vulnerability has a high severity with a CVSS score of 7.7 and is fixed in version 4.4.1. The vendor manages remediation for this cloud-hosted service.
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerability is fixed in 0.x.y-security-1.
Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.