# Server-side request forgery (SSRF). The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Server-Side Request Forgery (SSRF) in GitLab](https://agentprime.io/advisories/CVE-2026-9204.md) `CVE-2026-9204` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations](https://agentprime.io/advisories/GHSA-whpp-xv3h-rwxf.md) `GHSA-whpp-xv3h-rwxf`, `CVE-2026-40999` · Maven `org.springframework.ws:spring-ws-core`: affected `>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8`, fixed in `5.0.2`, `4.1.4` · CVSS 8.6 High · Not analysed yet · Published 11 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-20252.md) `CVE-2026-20252` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 7.6 High · Not analysed yet · Published 10 Jun 2026 · Tags: Server-side request forgery (SSRF) - [ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks](https://agentprime.io/advisories/CVE-2026-48858.md) `CVE-2026-48858` · CVE record: Erlang OTP · CVSS 6.3 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Roxy-WI: SSRF in /smon/agent/\/\ reachable to cloud metadata IPs](https://agentprime.io/advisories/CVE-2026-45561.md) `CVE-2026-45561` · CVE record: roxy-wi roxy-wi · CVSS 6.5 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Papra HTTP redirect bypass can lead to SSRF via webhook delivery system](https://agentprime.io/advisories/GHSA-5g86-85rp-f9hx.md) `GHSA-5g86-85rp-f9hx`, `CVE-2026-48051` · npm `@papra/webhooks`: affected `<0.3.3`, fixed in `0.3.3` · CVSS 3.5 Low · Not analysed yet · Published 10 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-47938.md) `CVE-2026-47938` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft Exchange Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-45504.md) `CVE-2026-45504` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 8.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft Exchange Server Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-45502.md) `CVE-2026-45502` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 5.0 Medium · EPSS 0.20 · Not analysed yet · Published 9 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft Exchange Server Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-45501.md) `CVE-2026-45501` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Spring Framework Server-Side Request Forgery via UriComponentsBuilder](https://agentprime.io/advisories/GHSA-7m2p-62gw-p8qq.md) `GHSA-7m2p-62gw-p8qq`, `CVE-2026-41854` · Maven `org.springframework:spring-web`: affected `>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19`, fixed in `7.0.8`, `6.2.19` · CVSS 4.2 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks](https://agentprime.io/advisories/GHSA-p2j4-c4g6-rpf5.md) `GHSA-p2j4-c4g6-rpf5`, `CVE-2026-47735`, `GO-2026-5523` · Go `github.com/basekick-labs/arc`: affected `<0.0.0-20260520141557-91bdc29d1a02`, fixed in `0.0.0-20260520141557-91bdc29d1a02` · CVSS 7.1 High · Not analysed yet · Published 8 Jun 2026 · Tags: Path traversal, Information disclosure, Server-side request forgery (SSRF) - [FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading](https://agentprime.io/advisories/GHSA-w86f-rf9w-h3x6.md) `GHSA-w86f-rf9w-h3x6`, `CVE-2026-47719` · npm `fuxa-server`: affected `<=1.1.14-1243`, no fixed version yet · CVSS 8.2 High · Not analysed yet · Published 8 Jun 2026 · Tags: Server-side request forgery (SSRF) - [GeoNode contains a server-side request forgery vulnerability in the service registration endpoint](https://agentprime.io/advisories/GHSA-hw9r-6m78-w6h3.md) `GHSA-hw9r-6m78-w6h3`, `CVE-2026-39922`, `PYSEC-2026-61` · PyPI `geonode`: affected `>=4.0.0, <4.4.5 || >=5.0.0, <5.0.2`, fixed in `4.4.5`, `5.0.2` · CVSS 5.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Server-side request forgery (SSRF) - [jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery](https://agentprime.io/advisories/CVE-2026-11469.md) `CVE-2026-11469` · CVE record: jishenghua jshERP · CVSS 5.1 Medium · Not analysed yet · Published 7 Jun 2026 · Tags: Server-side request forgery (SSRF) - [perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery](https://agentprime.io/advisories/CVE-2026-11437.md) `CVE-2026-11437` · CVE record: perfree go-fastdfs-web · CVSS 6.9 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery in Altium Platform Design GraphQL Service Allows Information Disclosure](https://agentprime.io/advisories/CVE-2026-11424.md) `CVE-2026-11424` · CVE record: Altium Altium Enterprise Server and 1 more · CVSS 8.3 High · Not analysed yet · Published 5 Jun 2026 · Tags: Information disclosure, Server-side request forgery (SSRF) - [Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP](https://agentprime.io/advisories/GHSA-q4x5-8cj6-52wg.md) `GHSA-q4x5-8cj6-52wg`, `CVE-2026-47684` · npm `@sync-in/server`: affected `<2.3.0`, fixed in `2.3.0` · CVSS 7.7 High · Not analysed yet · Published 5 Jun 2026 · Tags: Server-side request forgery (SSRF) - [NocoDB: Server-Side Request Forgery via Database Connection Host](https://agentprime.io/advisories/GHSA-w43h-r5m5-p832.md) `GHSA-w43h-r5m5-p832`, `CVE-2026-47382` · npm `nocodb`: affected `<2026.05.1`, fixed in `2026.05.1` · CVSS 5.3 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Omni: Operator can traverse image-factory API paths via unsanitized \`talos_version\` in CreateSchematic](https://agentprime.io/advisories/GHSA-c66c-vq6w-fvh5.md) `GHSA-c66c-vq6w-fvh5`, `CVE-2026-45723`, `GO-2026-5316` · Go `github.com/siderolabs/omni`: affected `<1.6.6 || >=1.7.0, <1.7.3`, fixed in `1.6.6`, `1.7.3` · CVSS 2.7 Low · Not analysed yet · Published 5 Jun 2026 · Tags: Path traversal, Information disclosure, Server-side request forgery (SSRF), CWE-20 - [Server-Side Request Forgery (SSRF) allowing Internal Network Probing in linqi](https://agentprime.io/advisories/CVE-2026-11346.md) `CVE-2026-11346` · CVE record: linqi GmbH linqi · CVSS 5.3 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-10586.md) `CVE-2026-10586` · CVE record: wpdevteam Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns · CVSS 7.2 High · Not analysed yet · Published 4 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation](https://agentprime.io/advisories/GHSA-gq96-5pfx-f4vc.md) `GHSA-gq96-5pfx-f4vc`, `CVE-2026-48013`, `PKSA-9x83-17hb-ky3t`, `PKSA-yg4m-g48j-bdvp` · Packagist `shopware/core` and 1 more: affected `>=6.7.0.0, <6.7.10.1`, fixed in `6.7.10.1` · CVSS 4.1 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Tautulli vulnerable to unauthenticated SSRF in /image/\ via attacker-seeded image hash replay](https://agentprime.io/advisories/CVE-2026-43986.md) `CVE-2026-43986` · CVE record: Tautulli Tautulli · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2026 · Tags: Server-side request forgery (SSRF) - [crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery](https://agentprime.io/advisories/CVE-2026-10771.md) `CVE-2026-10771` · CVE record: crmeb crmeb_java · CVSS 6.9 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Docling Core: Unsafe remote filename resolution](https://agentprime.io/advisories/GHSA-jmmv-h3mp-59v8.md) `GHSA-jmmv-h3mp-59v8`, `CVE-2026-44023`, `PYSEC-2026-2457` · PyPI `docling-core`: affected `>=1.5.0, <2.74.1`, fixed in `2.74.1` · CVSS 8.6 High · Not analysed yet · Published 3 Jun 2026 · Tags: Path traversal, Server-side request forgery (SSRF) - [Docling: Unsafe Playwright-based HTML Rendering](https://agentprime.io/advisories/GHSA-pj2v-ggqh-cmq2.md) `GHSA-pj2v-ggqh-cmq2`, `CVE-2026-44016`, `PYSEC-2026-2142` · PyPI `docling`: affected `>=2.82.0, <2.91.0`, fixed in `2.91.0` · CVSS 8.2 High · Not analysed yet · Published 3 Jun 2026 · Tags: Code injection, Server-side request forgery (SSRF) - [Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability](https://agentprime.io/advisories/CVE-2026-20230.md) `CVE-2026-20230` · CVE record: Cisco Cisco Unified Communications Manager · CVSS 8.6 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.89 · Not analysed yet · Published 3 Jun 2026 · Tags: Server-side request forgery (SSRF) - [DesktopCommanderMCP is vulnerable to SSRF](https://agentprime.io/advisories/GHSA-5xx3-j724-wmx5.md) `GHSA-5xx3-j724-wmx5`, `CVE-2026-10690` · npm `@wonderwhy-er/desktop-commander`: affected `<=0.2.37`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration.](https://agentprime.io/advisories/CVE-2026-26379.md) `CVE-2026-26379` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Server-side request forgery (SSRF) - [ahujasid blender-mcp ZIP File server.py requests.get server-side request forgery](https://agentprime.io/advisories/CVE-2026-10662.md) `CVE-2026-10662` · CVE record: ahujasid blender-mcp · CVSS 5.3 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint](https://agentprime.io/advisories/CVE-2026-49120.md) `CVE-2026-49120` · CVE record: medplum medplum · CVSS 6.3 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Server-side request forgery (SSRF) - [nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery](https://agentprime.io/advisories/CVE-2026-10583.md) `CVE-2026-10583` · CVE record: nextlevelbuilder GoClaw · CVSS 5.1 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Server-side request forgery (SSRF) - [DedeCMS download.php base64_decode server-side request forgery](https://agentprime.io/advisories/CVE-2026-10581.md) `CVE-2026-10581` · CVE record: DedeCMS · CVSS 5.3 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Nanobot contains a server-side request forgery vulnerability in the web_fetch tool](https://agentprime.io/advisories/GHSA-434r-7c99-hwf3.md) `GHSA-434r-7c99-hwf3`, `CVE-2026-49138`, `PYSEC-2026-3580` · PyPI `nanobot-ai`: affected `<0.2.1`, fixed in `0.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning](https://agentprime.io/advisories/CVE-2026-49139.md) `CVE-2026-49139` · CVE record: HKUDS nanobot · CVSS 7.0 High · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery](https://agentprime.io/advisories/CVE-2026-10287.md) `CVE-2026-10287` · CVE record: SourceCodester SEO Meta Tag Extractor · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery](https://agentprime.io/advisories/CVE-2026-10280.md) `CVE-2026-10280` · CVE record: horizon921 mcpilot · CVSS 6.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery](https://agentprime.io/advisories/CVE-2026-10276.md) `CVE-2026-10276` · CVE record: hekmon8 Jenkins-server-mcp · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [indrasishbanerjee aem-mcp-server Axios Request Flow mcp-server.ts getAssetMetadata server-side request forgery](https://agentprime.io/advisories/CVE-2026-10274.md) `CVE-2026-10274` · CVE record: indrasishbanerjee aem-mcp-server · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component](https://agentprime.io/advisories/GHSA-vqc2-c9jh-3jjv.md) `GHSA-vqc2-c9jh-3jjv`, `CVE-2026-49328` · Maven `org.apache.fesod:fesod-sheet`: affected `<2.0.2-incubating`, fixed in `2.0.2-incubating` · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints](https://agentprime.io/advisories/GHSA-698x-9w2p-7vvp.md) `GHSA-698x-9w2p-7vvp`, `CVE-2026-10517`, `GO-2026-5939` · Go `github.com/quay/claircore`: affected `<=1.5.52`, no fixed version yet · CVSS 5.8 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet server-side request forgery](https://agentprime.io/advisories/CVE-2026-10241.md) `CVE-2026-10241` · CVE record: jeecgboot The server processes these URLs · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [JeecgBoot test server-side request forgery](https://agentprime.io/advisories/CVE-2026-10240.md) `CVE-2026-10240` · CVE record: JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [JeecgBoot edit WordUtil.addImage server-side request forgery](https://agentprime.io/advisories/CVE-2026-10239.md) `CVE-2026-10239` · CVE record: JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint](https://agentprime.io/advisories/GHSA-hchg-qm84-cj9p.md) `GHSA-hchg-qm84-cj9p`, `CVE-2026-10177`, `PYSEC-2026-2336` · PyPI `aider-chat`: affected `<=0.86.2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Server-side request forgery (SSRF) - [PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings](https://agentprime.io/advisories/GHSA-5c6w-wwfq-7qqm.md) `GHSA-5c6w-wwfq-7qqm`, `CVE-2026-47390`, `PYSEC-2026-2902`, `PYSEC-2026-2941` · PyPI `praisonai` and 1 more: affected `<4.6.40`, fixed in `4.6.40` · CVSS 5.5 Medium · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host](https://agentprime.io/advisories/GHSA-6x26-5727-rrm9.md) `GHSA-6x26-5727-rrm9`, `CVE-2026-47268`, `GO-2026-5194` · Go `github.com/naiba/nezha` and 1 more: affected `>=0.20.0`, no fixed version yet · CVSS 6.4 Medium · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [Spatie Laravel Media Library contains a server-side request forgery vulnerability](https://agentprime.io/advisories/GHSA-fggg-964j-3j7h.md) `GHSA-fggg-964j-3j7h`, `CVE-2026-48555`, `PKSA-88bj-c5ky-3pr6` · Packagist `spatie/laravel-medialibrary`: affected `<11.23.0`, fixed in `11.23.0` · CVSS 5.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [CC-Tweaked has an SSRF Protection Bypass with NAT64](https://agentprime.io/advisories/GHSA-5jh9-2h63-pw4q.md) `GHSA-5jh9-2h63-pw4q`, `CVE-2026-47695` · Maven `cc.tweaked:cc-tweaked-1.19.3-core` and 7 more: affected `<1.119.0`, fixed in `1.119.0` · CVSS 7.1 High · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs](https://agentprime.io/advisories/GHSA-7j2f-6h2r-6cqc.md) `GHSA-7j2f-6h2r-6cqc`, `CVE-2026-47260`, `PKSA-bprq-tfgm-1hd2` · Packagist `phanan/koel`: affected `<9.3.5`, fixed in `9.3.5` · CVSS 7.7 High · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [FastGPT: SSRF Protection Bypass via \`externalFile\` in Dataset Preview API](https://agentprime.io/advisories/CVE-2026-44285.md) `CVE-2026-44285` · CVE record: labring FastGPT · CVSS 7.7 High · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2026-49372.md) `CVE-2026-49372` · CVE record: JetBrains TeamCity · CVSS 7.5 High · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes](https://agentprime.io/advisories/GHSA-86m8-88fq-xfxp.md) `GHSA-86m8-88fq-xfxp`, `CVE-2026-45741`, `GO-2026-5244` · Go `github.com/gotenberg/gotenberg/v8`: affected `<=8.32.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF), CWE-184 - [MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint](https://agentprime.io/advisories/CVE-2026-10107.md) `CVE-2026-10107` · CVE record: jxxghp MoviePilot · CVSS 7.0 High · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)](https://agentprime.io/advisories/GHSA-pjwm-pj3p-43mv.md) `GHSA-pjwm-pj3p-43mv`, `CVE-2026-44492` · npm `axios`: affected `<0.32.0 || >=1.15.0, <1.16.0`, fixed in `0.32.0`, `1.16.0` · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF), CWE-289 - [Shibby Tomato SUBSCRIBE Call miniupnpd send server-side request forgery](https://agentprime.io/advisories/CVE-2026-10068.md) `CVE-2026-10068` · CVE record: Shibby Tomato · CVSS 6.9 Medium · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation](https://agentprime.io/advisories/CVE-2026-42965.md) `CVE-2026-42965` · CVE record: Red Hat Red Hat OpenShift Container Platform 4.17 and 4 more · CVSS 7.7 High · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints](https://agentprime.io/advisories/CVE-2026-10052.md) `CVE-2026-10052` · CVE record: Red Hat Red Hat Quay 3 · CVSS 4.1 Medium · Not analysed yet · Published 29 May 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access](https://agentprime.io/advisories/CVE-2026-49093.md) `CVE-2026-49093` · CVE record: Elastic Kibana · CVSS 6.3 Medium · Not analysed yet · Published 28 May 2026 · Tags: Server-side request forgery (SSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .