Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9,107 results · page 3 of 183
Oct 16, 2026fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the serverCVE-2026-111720 · Other software · lhccong · reported by VulnCheckMedium 6.9
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons.
- Product
- fish-island-backend
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using CVE-2026-111692 · Other software · databufflabs · reported by VulnCheckCritical 9.3
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.
- Product
- databuff
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by usiCVE-2026-111690 · Other software · suyuan32 · reported by VulnCheckCritical 9.3
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.
- Product
- simple-admin-core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUploadCVE-2026-111663 · Other software · chaskiq · reported by VulnCheckCritical 9.2
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.
- Product
- chaskiq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via theCVE-2026-111662 · Other software · chaskiq · reported by VulnCheckMedium 6.9
Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService, which follows redirects and skips TLS verification, to read internal page titles and descriptions.
- Product
- chaskiq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callbCVE-2026-111659 · Other software · wayn111 · reported by VulnCheckMedium 6.9
Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.
- Product
- waynboot-mall
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonatinCVE-2026-111642 · Other software · fastapiadmin · reported by VulnCheckHigh 8.7
FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens impersonating the superuser. Attackers can register via the unauthenticated /api/v1/system/user/register endpoint, log in, and forge an HS256 token keeping their session_id but naming the superuser in user_name to gain superuser privileges.
- Product
- FastapiAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens usinCVE-2026-111636 · Other software · OpenBMB · reported by VulnCheckCritical 9.2
OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.
- Product
- StaffDeck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-codedCVE-2026-111633 · Other software · SeriaWei · reported by VulnCheckHigh 8.8
ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers can sign a token with the Name claim set to 'admin' to call ApiAuthorize endpoints, modifying articles and products and reading form submissions.
- Product
- ZKEACMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026aThemeArt Theme Helper: Cross-Site Request Forgery (CSRF)CVE-2026-111413 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8.
- Product
- aThemeArt Theme Helper
- Affected
- up to 1.0.8
- What to do
- Affects up to 1.0.8. Update aThemeArt Theme Helper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 16, 2026Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate thCVE-2026-110805 · Other software · Devolutions · reported by security@devolutions.netLow 2.6
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2026Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow.CVE-2026-101300 · Other software · Wegow Technologies · reported by cve-coordination@incibe.esHigh 7.1
Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF. The content is processed by the export.highcharts.com service, which sends HTTP requests to attacker-controlled external resources and embeds their responses in the generated PDF. The reported behavior allows the export service to be used as an intermediary for these requests.
- Product
- Wegow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JCVE-2026-111367 · Other software · aaPanel · reported by VulnCheckMedium 6.9
BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions.
- Product
- BillionMail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url cCVE-2026-111323 · Other software · samugit83 · reported by VulnCheckMedium 6.9
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata services, receiving fetched content through the model-generated summary.
- Product
- RedAmon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requestCVE-2026-111321 · Other software · TaskingAI · reported by VulnCheckMedium 5.3
TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers[0].url in a user-defined action. Attackers holding a project API key or console admin login can create an action pointing to loopback, internal or cloud metadata addresses and run it via POST /actions/{action_id}/run to read back up to 64 KiB of responses.
- Product
- TaskingAI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by settinCVE-2026-111320 · Other software · ValueCell-ai · reported by VulnCheckMedium 6.9
ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider config endpoint and trigger POST /api/v1/models/check to reach internal or metadata addresses, read error responses, and capture stored provider API keys.
- Product
- ValueCell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthCVE-2026-111313 · Other software · DaKheera47 · reported by VulnCheckHigh 7.1
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.
- Product
- JobOps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController).CVE-2026-106708 · Other software · reported by MITREHigh 8.8
XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController). The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-maCVE-2026-111171 · Other software · ethereum · reported by VulnCheckMedium 6.3
Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side request forgery vulnerability because _check_ip_blocked() does not unwrap IPv4-mapped IPv6 addresses in CCIP Read URL validation. Malicious contracts can return OffchainLookup URLs with IPv4-mapped IPv6 hosts or AAAA records, making clients with CCIP Read enabled send requests to loopback, private, or link-local services.
- Product
- web3.py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and CVE-2026-110746 · Other software · TotalSecurity · reported by cret@cert.orgHigh 7.8
A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.
- Product
- TotalAV
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station.CVE-2026-39989 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.3
A server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312 and later Download Station 5.11.2.321 and later
- Product
- Download Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2026PhastPress: Server-Side Request ForgeryCVE-2026-3712 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
- Product
- PhastPress
- Affected
- up to 3.10
- What to do
- Affects up to 3.10. Update PhastPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 14, 2026Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs viCVE-2026-110868 · Other software · renovatebot · reported by VulnCheckHigh 8.4
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.
- Product
- renovate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 14, 2026A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network reqCVE-2026-0311 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comLow 1.1
A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.
- Product
- Checkov by Prisma Cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.com
Oct 14, 2026Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and DockerCVE-2026-110719 · Other software · Portkey-AI · reported by VulnCheckMedium 6.9
Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.
- Product
- gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internaCVE-2026-110718 · Other software · TurboDocx · reported by VulnCheckHigh 8.2
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.
- Product
- html-to-docx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix foCVE-2026-110628 · Other software · kanbn · reported by VulnCheckCritical 9.2
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
- Product
- kan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key inCVE-2026-110612 · Other software · wwwlike · reported by VulnCheckCritical 9.3
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token with superUser=true and arbitrary groupIds claims to gain super administrator access to any URL on vlife instances.
- Product
- vlife
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make CVE-2026-110610 · Other software · YunaiV · reported by VulnCheckMedium 5.3
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supplying referImageUrl to the midjourney imagine endpoint. Attackers can force Hutool HttpUtil.downloadBytes() requests to loopback, private, or cloud metadata addresses to probe internal-only HTTP services and reach metadata endpoints.
- Product
- ruoyi-vue-pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows rCVE-2026-110652 · Other software · ONLYOFFICE · reported by VulnCheckMedium 6.3
ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side request forgery vulnerability in the /downloadfile/:docid endpoint that allows remote attackers to bypass the private-IP request-filtering-agent by exploiting the isInJwtToken flag when JWT verification is disabled in the default configuration. Attackers can submit a crafted request body containing an internal or loopback URL, which is treated as a DIRECT request skipping private-address filtering, causing the server to fetch and proxy back arbitrary private-network and cloud metadata content.
- Product
- DocumentServer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.CVE-2026-95634 · Other software · Adobe · reported by AdobeHigh 8.6
CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.CVE-2026-76001 · Websites & servers · Adobe · reported by AdobeHigh 7.1
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.CVE-2026-75748 · Websites & servers · Adobe · reported by AdobeHigh 7.6
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.CVE-2026-34634 · Websites & servers · Adobe · reported by AdobeHigh 8.6
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.CVE-2026-34633 · Websites & servers · Adobe · reported by AdobeHigh 7.7
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.CVE-2026-106622 · Websites & servers · Adobe · reported by AdobeCritical 10
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.CVE-2026-105897 · Websites & servers · Adobe · reported by AdobeHigh 8.6
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.CVE-2026-96204 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
- Product
- Arc Enabled Servers - Azure Connected Machine Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-88206 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-70259 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-70251 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-70202 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.5
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch CVE-2026-110255 · Other software · Finsys · reported by VulnCheckHigh 8.4
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.
- Product
- dockhand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to CVE-2026-110254 · Other software · Finsys · reported by VulnCheckMedium 5.3
Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.
- Product
- dockhand
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 13, 2026Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetCVE-2026-110225 · Other software · shaarli · reported by VulnCheckMedium 5.1
Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.
- Product
- Shaarli
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinCVE-2026-110223 · Other software · Kareadita · reported by VulnCheckLow 2.3
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresses after validation, enabling blind internal port and service probing.
- Product
- Kavita
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a craftedCVE-2026-110222 · Other software · Razorpay · reported by VulnCheckMedium 6.9
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSC#get. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host, sending GET requests to internal or attacker-chosen hosts and returning parsed response fields.
- Product
- IFSC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount tCVE-2026-110220 · Other software · Kubeflow · reported by VulnCheckHigh 7.1
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.
- Product
- Model Registry
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint CVE-2026-110214 · Other software · xiaonuobase · reported by VulnCheckMedium 6.3
Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments.
- Product
- Snowy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.CVE-2026-105713 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.7
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.