76 CVEs — updated 2026-11-02 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-55598 | PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can | CRITICAL | 9.1 | 26%ile | NVD | 2026-10-30 |
| CVE-2026-13303 | HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store | HIGH | 8.7 | 13%ile | NVD | 2026-10-29 |
| CVE-2026-118660 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy D | HIGH | 8.6 | 35%ile | NVD | 2026-10-28 |
| CVE-2026-61572 | AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/func | HIGH | 8.6 | 17%ile | NVD | 2026-10-28 |
| CVE-2026-62284 | OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfi | HIGH | 8.6 | 43%ile | NVD | 2026-10-30 |
| CVE-2025-14260 | Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to reso | HIGH | 8.3 | 20%ile | NVD | 2026-10-28 |
| CVE-2026-116826 | YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that all | HIGH | 8.2 | 15%ile | NVD | 2026-10-27 |
| CVE-2026-116827 | YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() f | HIGH | 8.2 | 28%ile | NVD | 2026-10-27 |
| GHSA-4mfg-r38w-w8fg | mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 | HIGH | 8.2 | — | GitHub | 2026-10-28 |
| CVE-2026-88967 | A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-contro | HIGH | 7.7 | 22%ile | NVD | 2026-10-28 |
| CVE-2026-13451 | A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources | HIGH | 7.7 | 12%ile | NVD | 2026-10-28 |
| CVE-2026-88809 | A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended | HIGH | 7.6 | — | NVD | 2026-11-02 |
| CVE-2026-118659 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Hap | HIGH | 7.5 | 33%ile | NVD | 2026-10-28 |
| CVE-2026-111418 | A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service | HIGH | 7.5 | 38%ile | NVD | 2026-10-29 |
| CVE-2025-59775 | Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF | HIGH | 7.5 | 57%ile | Microsoft | 2025-12-09 |
| CVE-2026-24269 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful e | HIGH | 7.1 | 4%ile | NVD | 2026-10-27 |
| CVE-2026-65120 | NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful e | HIGH | 7.1 | 4%ile | NVD | 2026-10-27 |
| CVE-2026-66090 | In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user | HIGH | 7.1 | 19%ile | NVD | 2026-10-29 |
| CVE-2026-119549 | Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecur | HIGH | 7.1 | 38%ile | NVD | 2026-10-30 |
| CVE-2026-119575 | ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users | HIGH | 7.1 | 17%ile | NVD | 2026-10-30 |
| CVE-2026-116252 | pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq tre | HIGH | 7.1 | 17%ile | NVD | 2026-10-30 |
| CVE-2026-63184 | Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet to | HIGH | 7.1 | 35%ile | NVD | 2026-10-30 |
| CVE-2026-117565 | Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers | MEDIUM | 6.9 | 34%ile | NVD | 2026-10-27 |
| CVE-2026-118679 | n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhoo | MEDIUM | 6.9 | 20%ile | NVD | 2026-10-28 |
| CVE-2026-118586 | A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the fi | MEDIUM | 6.9 | 24%ile | NVD | 2026-10-29 |
| CVE-2026-119122 | Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API cl | MEDIUM | 6.9 | 31%ile | NVD | 2026-10-29 |
| CVE-2026-119545 | Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a server-side request forgery vulnera | MEDIUM | 6.9 | 39%ile | NVD | 2026-10-30 |
| CVE-2026-119709 | Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata P | MEDIUM | 6.9 | 35%ile | NVD | 2026-10-30 |
| CVE-2026-119343 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST | MEDIUM | 6.8 | 21%ile | NVD | 2026-10-30 |
| CVE-2026-116686 | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1. | MEDIUM | 6.5 | 27%ile | NVD | 2026-10-27 |
| CVE-2026-55098 | Arc is an open, SQL-native time-series database for telemetry. Prior to the repository-verified 26.06.2 repair, the reme | MEDIUM | 6.5 | 25%ile | NVD | 2026-10-30 |
| CVE-2026-48858 | ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks | MEDIUM | 6.5 | 14%ile | Microsoft | 2026-06-09 |
| CVE-2026-57211 | RabbitMQ: UNC SSRF affecting the management UI on Windows | MEDIUM | 6.5 | 50%ile | Microsoft | 2026-07-14 |
| CVE-2026-116680 | HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs wi | MEDIUM | 6.4 | 9%ile | NVD | 2026-10-27 |
| CVE-2026-13318 | Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip | MEDIUM | 6.4 | 15%ile | Microsoft | 2026-06-09 |
| CVE-2026-119428 | phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to t | MEDIUM | 6.3 | 24%ile | NVD | 2026-10-30 |
| CVE-2026-120492 | Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass pat | MEDIUM | 6.3 | — | NVD | 2026-11-02 |
| CVE-2026-57448 | Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the adm | MEDIUM | 6.2 | 28%ile | NVD | 2026-10-28 |
| CVE-2026-66089 | In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves ext | MEDIUM | 6.1 | 19%ile | NVD | 2026-10-29 |
| CVE-2026-118766 | Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while po | MEDIUM | 6.1 | 1%ile | NVD | 2026-10-29 |
| CVE-2026-118376 | WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-p | MEDIUM | 6.0 | 20%ile | NVD | 2026-10-28 |
| CVE-2026-56084 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7 | MEDIUM | 5.8 | 12%ile | NVD | 2026-10-27 |
| CVE-2026-116678 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader v | MEDIUM | 5.8 | 26%ile | NVD | 2026-10-27 |
| CVE-2026-115225 | The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group l | MEDIUM | 5.8 | 16%ile | NVD | 2026-10-28 |
| CVE-2025-13281 | Portworx Half-Blind SSRF in kube-controller-manager | MEDIUM | 5.8 | 33%ile | Microsoft | 2025-12-09 |
| CVE-2026-86144 | In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This ha | MEDIUM | 5.6 | 8%ile | Microsoft | 2026-09-08 |
| CVE-2026-117471 | Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo devic | MEDIUM | 5.4 | 15%ile | NVD | 2026-10-27 |
| CVE-2026-104331 | IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticat | MEDIUM | 5.4 | 8%ile | NVD | 2026-10-29 |
| CVE-2026-114620 | Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF | MEDIUM | 5.4 | 33%ile | GitHub | 2026-10-27 |
| CVE-2026-70367 | Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loo | MEDIUM | 5.4 | 5%ile | Microsoft | 2026-08-11 |
| CVE-2026-113688 | Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3 | MEDIUM | 5.3 | 24%ile | NVD | 2026-10-29 |
| CVE-2026-107046 | A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows att | MEDIUM | 5.3 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-119712 | PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows | MEDIUM | 5.3 | 17%ile | NVD | 2026-10-30 |
| CVE-2026-119342 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.1 | MEDIUM | 5.3 | 38%ile | NVD | 2026-10-30 |
| CVE-2026-118989 | WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability | MEDIUM | 5.1 | 19%ile | NVD | 2026-10-29 |
| CVE-2026-102590 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to | MEDIUM | 5.0 | 21%ile | NVD | 2026-10-29 |
| CVE-2026-71569 | Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from | MEDIUM | 4.8 | 28%ile | NVD | 2026-10-29 |
| CVE-2026-54442 | NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571 | MEDIUM | 4.8 | — | GitHub | 2026-10-30 |
| CVE-2026-61529 | Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /f | MEDIUM | 4.7 | 11%ile | NVD | 2026-10-28 |
| CVE-2026-87897 | A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentic | MEDIUM | 4.6 | 10%ile | NVD | 2026-10-27 |
| CVE-2026-104310 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to | MEDIUM | 4.3 | 17%ile | NVD | 2026-10-29 |
| CVE-2026-104315 | IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticat | MEDIUM | 4.3 | 11%ile | NVD | 2026-10-29 |
| CVE-2026-107310 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue af | MEDIUM | 4.3 | 9%ile | NVD | 2026-10-30 |
| CVE-2026-67077 | HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the ap | MEDIUM | 4.2 | 2%ile | NVD | 2026-10-28 |
| CVE-2026-48522 | PyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes | MEDIUM | 4.2 | 13%ile | Microsoft | 2026-05-12 |
| GHSA-7wpf-ch8f-5f4x | signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher | MEDIUM | 4.2 | — | GitHub | 2026-10-30 |
| CVE-2026-100355 | Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the ser | LOW | 3.1 | 20%ile | NVD | 2026-10-30 |
| CVE-2026-101209 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability. A high | LOW | 2.7 | 20%ile | NVD | 2026-10-30 |
| CVE-2026-61840 | Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the `image to GIF` command uses a request helper that validates | LOW | 2.3 | 23%ile | NVD | 2026-10-30 |
| CVE-2026-118577 | A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the c | LOW | 2.1 | 14%ile | NVD | 2026-10-28 |
| CVE-2026-118172 | The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect | UNKNOWN | — | 8%ile | NVD | 2026-10-27 |
| CVE-2026-74759 | Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS exte | UNKNOWN | — | 7%ile | NVD | 2026-11-01 |
| CVE-2026-46683 | Snappy: SSRF and local file read via the xsl-style-sheet option | UNKNOWN | — | 16%ile | Microsoft | 2026-06-09 |
| CVE-2026-8328 | FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address | UNKNOWN | — | 40%ile | Microsoft | 2026-05-12 |
| CVE-2026-71196 | OSSA-2026-038: Multiple SSRF vulnerabilities in Glance web-download and HTTP image APIs | UNKNOWN | — | — | OpenStack | 2026-09-03 |
| FG-IR-26-159 | Server-Side Request Forgery (SSRF) | UNKNOWN | — | — | Fortinet | 2026-08-12 |