Vulnerability-Lookup has a server-side request forgery (SSRF) vulnerability in its remote-instance synchronization feature. An authenticated administrator can configure remote instance addresses that are insufficiently validated, allowing the server to make HTTP(S) requests to internal or restricted network resources. This includes internal, loopback, link-local, or cloud metadata services. The vulnerability arises because the server follows redirects without revalidating destinations and does not enforce network boundary restrictions. A patch was introduced to restrict outbound URLs, reject non-public IP addresses, and validate redirects to prevent access to internal resources.