Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-34633
High · 7.7
CWE-918 Oct 13, 2026
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-106622
Critical · 10.0
CWE-918 Oct 13, 2026
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-105897
High · 8.6
CWE-918 Oct 13, 2026
ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-96204
Medium · 6.5
CWE-918 Oct 13, 2026
Azure Arc Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
CVE-2026-88206
High · 7.5
CWE-918 Oct 13, 2026
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-70259
Medium · 6.5
CWE-918 Oct 13, 2026
Microsoft Office SharePoint Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2026-70251
High · 7.5
CWE-918 Oct 13, 2026
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-70202
High · 7.5
CWE-918 Oct 13, 2026
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-110255
High · 8.5
CWE-918 Oct 13, 2026
Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary URLs by supplying repository URL and stackfile values. Attackers can send stack templates pointing to internal services or cloud metadata endpoints and read the fetched content from the compose response field, exposing credentials and tokens.
CVE-2026-110254
Medium · 4.3
CWE-918 Oct 13, 2026
Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory
Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.
CVE-2026-110240
Medium · 4.8
CWE-918 Oct 13, 2026
Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses as external. Attackers can supply hostnames resolving to these address forms, including NAT64, 6to4 or Teredo embedding internal IPv4, to reach internal services or cloud metadata endpoints.
CVE-2026-110225
Low · 2.7
CWE-918 Oct 13, 2026
Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route
Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to loopback, private, or cloud metadata addresses and trigger ThumbnailsController::ajaxUpdate or saving to send blind GET requests, with open_shaarli exposing this to any visitor.
CVE-2026-110223
Low · 3.1
CWE-918 Oct 13, 2026
Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint
Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or HTTPS redirects. Attackers can submit a URL to POST /api/Cbl/upload-cbl-file whose host rebinds or redirects to internal addresses after validation, enabling blind internal port and service probing.
CVE-2026-110222
Medium · 5.3
CWE-918 Oct 13, 2026
Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSC#get. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host, sending GET requests to internal or attacker-chosen hosts and returning parsed response fields.
CVE-2026-110220
High · 7.1
CWE-918 Oct 13, 2026
Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation
Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.
CVE-2026-105713
Medium · 5.7
CWE-918 Oct 13, 2026
Microsoft Office SharePoint Spoofing Vulnerability
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.
CVE-2026-107460
Critical · 9.1
CWE-918 Oct 13, 2026
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod ...
Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet writing, the converter checks the hostname's resolved IP addresses and then opens a separate connection that can resolve the hostname again. An attacker who controls DNS responses for the URL hostname may cause the connection to reach a restricted address after validation. CVE-2026-49328 covers SSRF in releases before 2.0.2-incubating; this issue is a DNS rebinding bypass of the protection in 2.0.2-incubating. Apache Fesod (Incubating) 2.1.0-incubating addresses the reported default-fetch scenario by disabling remote URL image fetching by default and requiring an explicit exact-host allowlist when the feature is enabled. Users should upgrade to 2.1.0-incubating. Applications enabling remote URL image fetching should allowlist only hostnames whose DNS and HTTP services are trusted.
CVE-2024-34319
Medium · 6.5
CWE-918 Oct 13, 2026
A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403...
A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request.
CVE-2026-65170
High · 8.6
CWE-918 Oct 13, 2026
NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an...
NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend where an unauthenticated remote attacker may cause server-side request forgery by supplying a crafted original URL. A successful exploit of this vulnerability may lead to information disclosure.
CVE-2026-65101
High · 8.6
CWE-918 Oct 13, 2026
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an...
NVIDIA AIStore for Linux contains a vulnerability in the distributed sort component where an attacker could cause server-side request forgery by supplying a crafted external key map URL. A successful exploit of this vulnerability might lead to information disclosure.
CVE-2026-109405
High · 7.3
CWE-918 Oct 13, 2026
conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
CVE-2026-109404
Medium · 5.3
CWE-918 Oct 13, 2026
conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery
A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible.
CVE-2026-109403
High · 7.3
CWE-918 Oct 13, 2026
conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-109402
Medium · 6.3
CWE-918 Oct 13, 2026
conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery
A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used.
CVE-2026-109190
Medium · 6.3
CWE-918 Oct 13, 2026
conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery
A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.