Threats affecting pkg:github/HummerRisk

CVE-2026-6220 is a server-side request forgery (SSRF) vulnerability in HummerRisk versions up to 1.5.0. It affects the ServerService.addServer function in the Video File Download URL Handler component. The vulnerability arises from manipulation of the streamIp argument, allowing remote attackers to induce the server to make unintended requests. The exploit code is publicly available. The vendor has not responded to disclosure attempts and no official remediation or patch has been provided. The CVSS 4.0 base score is 5.