agentprime: Server-side request forgery (SSRF)Every new Server-side request forgery (SSRF) Advisory and CVE.https://agentprime.io/CVE-2026-88981: Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpointshttps://agentprime.io/advisories/CVE-2026-88981/https://agentprime.io/advisories/CVE-2026-88981/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 22:21:30 GMTCVECVE-2026-88980: Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validatorhttps://agentprime.io/advisories/CVE-2026-88980/https://agentprime.io/advisories/CVE-2026-88980/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 22:18:05 GMTCVECVE-2026-88979: Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxyhttps://agentprime.io/advisories/CVE-2026-88979/https://agentprime.io/advisories/CVE-2026-88979/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 22:14:38 GMTCVECVE-2026-88983: Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validationhttps://agentprime.io/advisories/CVE-2026-88983/https://agentprime.io/advisories/CVE-2026-88983/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 21:58:53 GMTCVECVE-2026-81190: KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRFhttps://agentprime.io/advisories/CVE-2026-81190/https://agentprime.io/advisories/CVE-2026-81190/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:52:19 GMTCVECVE-2026-69137: SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosurehttps://agentprime.io/advisories/CVE-2026-69137/https://agentprime.io/advisories/CVE-2026-69137/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:21:17 GMTCVECVE-2026-123204: Posta before v0.18.0 SSRF via Webhook URLhttps://agentprime.io/advisories/CVE-2026-123204/https://agentprime.io/advisories/CVE-2026-123204/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:16:39 GMTCVECVE-2026-123201: buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle APIhttps://agentprime.io/advisories/CVE-2026-123201/https://agentprime.io/advisories/CVE-2026-123201/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:16:37 GMTCVECVE-2026-61649: SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal serviceshttps://agentprime.io/advisories/CVE-2026-61649/https://agentprime.io/advisories/CVE-2026-61649/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:15:54 GMTCVECVE-2026-63111: SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cronhttps://agentprime.io/advisories/CVE-2026-63111/https://agentprime.io/advisories/CVE-2026-63111/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:09:36 GMTCVECVE-2026-123125: Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypasshttps://agentprime.io/advisories/CVE-2026-123125/https://agentprime.io/advisories/CVE-2026-123125/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:55:11 GMTCVECVE-2026-115740: Server-side request forgery in Trellix DLP on-prem extensionshttps://agentprime.io/advisories/CVE-2026-115740/https://agentprime.io/advisories/CVE-2026-115740/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:26:31 GMTCVECVE-2026-81828: Apache OFBiz: Server-side request forgery in SurveyWrapperhttps://agentprime.io/advisories/CVE-2026-81828/https://agentprime.io/advisories/CVE-2026-81828/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:06:07 GMTCVECVE-2026-82902: Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafilehttps://agentprime.io/advisories/CVE-2026-82902/https://agentprime.io/advisories/CVE-2026-82902/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:05:23 GMTCVECVE-2026-123119: Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)https://agentprime.io/advisories/CVE-2026-123119/https://agentprime.io/advisories/CVE-2026-123119/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 12:57:35 GMTCVECVE-2026-102337: Webmin: SSRF exploit in Upload and Download and File Manager moduleshttps://agentprime.io/advisories/CVE-2026-102337/https://agentprime.io/advisories/CVE-2026-102337/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 22:56:51 GMTCVECVE-2026-57566: Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxyhttps://agentprime.io/advisories/CVE-2026-57566/https://agentprime.io/advisories/CVE-2026-57566/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 21:44:27 GMTCVEcriticalCVE-2026-97373: draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hostshttps://agentprime.io/advisories/CVE-2026-97373/https://agentprime.io/advisories/CVE-2026-97373/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:52:51 GMTCVECVE-2026-122140: Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypasshttps://agentprime.io/advisories/CVE-2026-122140/https://agentprime.io/advisories/CVE-2026-122140/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:36:57 GMTCVECVE-2026-122009: DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgeryhttps://agentprime.io/advisories/CVE-2026-122009/https://agentprime.io/advisories/CVE-2026-122009/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:30:17 GMTCVECVE-2026-121927: InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgeryhttps://agentprime.io/advisories/CVE-2026-121927/https://agentprime.io/advisories/CVE-2026-121927/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 17:45:11 GMTCVECVE-2026-122008: Oqtane Framework before 10.3.0 SSRF via File Upload From URLhttps://agentprime.io/advisories/CVE-2026-122008/https://agentprime.io/advisories/CVE-2026-122008/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 14:48:13 GMTCVECVE-2026-121936: easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS APIhttps://agentprime.io/advisories/CVE-2026-121936/https://agentprime.io/advisories/CVE-2026-121936/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 12:31:16 GMTCVECVE-2026-111036: Multiple vulnerabilities in Coupa’s Total Spend Management Platformhttps://agentprime.io/advisories/CVE-2026-111036/https://agentprime.io/advisories/CVE-2026-111036/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 09:29:51 GMTCVECVE-2026-118422: Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Pathhttps://agentprime.io/advisories/CVE-2026-118422/https://agentprime.io/advisories/CVE-2026-118422/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 06:00:28 GMTCVECVE-2026-110692: PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Importhttps://agentprime.io/advisories/CVE-2026-110692/https://agentprime.io/advisories/CVE-2026-110692/CVSS 4.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 06:00:25 GMTCVECVE-2026-118628: MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-118628/https://agentprime.io/advisories/CVE-2026-118628/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 23:46:07 GMTCVECVE-2026-121581: ArcReel Provider Test-Connection Endpoint test server-side request forgeryhttps://agentprime.io/advisories/CVE-2026-121581/https://agentprime.io/advisories/CVE-2026-121581/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 22:45:19 GMTCVECVE-2026-120715: Server-side request forgery in Devolutions Serverhttps://agentprime.io/advisories/CVE-2026-120715/https://agentprime.io/advisories/CVE-2026-120715/Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:34:30 GMTCVECVE-2026-121580: Server-side request forgery in Devolutions Serverhttps://agentprime.io/advisories/CVE-2026-121580/https://agentprime.io/advisories/CVE-2026-121580/Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:28:01 GMTCVECVE-2026-105822: Server-Side Request Forgery in Tapo Cloud MQTT Proxyhttps://agentprime.io/advisories/CVE-2026-105822/https://agentprime.io/advisories/CVE-2026-105822/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 19:41:21 GMTCVECVE-2026-114582: Server-side request forgery via SpatialReference string inputhttps://agentprime.io/advisories/CVE-2026-114582/https://agentprime.io/advisories/CVE-2026-114582/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 15:43:04 GMTCVECVE-2026-111362: Server-side request forgery via crs member of GeoJSON geometrieshttps://agentprime.io/advisories/CVE-2026-111362/https://agentprime.io/advisories/CVE-2026-111362/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 15:42:14 GMTCVECVE-2026-121561: Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloadshttps://agentprime.io/advisories/CVE-2026-121561/https://agentprime.io/advisories/CVE-2026-121561/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 15:17:17 GMTCVECVE-2026-121431: AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectorshttps://agentprime.io/advisories/CVE-2026-121431/https://agentprime.io/advisories/CVE-2026-121431/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 14:28:25 GMTCVECVE-2026-121422: SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypasshttps://agentprime.io/advisories/CVE-2026-121422/https://agentprime.io/advisories/CVE-2026-121422/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 14:28:18 GMTCVECVE-2026-121421: SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypasshttps://agentprime.io/advisories/CVE-2026-121421/https://agentprime.io/advisories/CVE-2026-121421/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 14:28:18 GMTCVECVE-2026-121420: SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresseshttps://agentprime.io/advisories/CVE-2026-121420/https://agentprime.io/advisories/CVE-2026-121420/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 14:28:17 GMTCVECVE-2026-89292: Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructureshttps://agentprime.io/advisories/CVE-2026-89292/https://agentprime.io/advisories/CVE-2026-89292/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 09:31:27 GMTCVEcriticalTYPO3-EXT-SA-2026-037: Server-Side Request Forgery in extension "Mail" (mail)https://agentprime.io/advisories/PKSA-spg7-jb73-vpnk/https://agentprime.io/advisories/PKSA-spg7-jb73-vpnk/mediaessenz/mail <3.12.5 || >=4.0.0, <4.2.0, fixed in 3.12.5, 4.2.0. CVSS 5.3 (Medium). Published by Packagist. Not analysed by agentprime yet.Tue, 03 Nov 2026 09:00:00 GMTPackagistmediaessenz/mailCVE-2026-105967: Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameterhttps://agentprime.io/advisories/CVE-2026-105967/https://agentprime.io/advisories/CVE-2026-105967/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 06:00:23 GMTCVECVE-2026-120416: AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgeryhttps://agentprime.io/advisories/CVE-2026-120416/https://agentprime.io/advisories/CVE-2026-120416/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 18:00:24 GMTCVECVE-2026-88809: Rancher meta proxy allowlist bypass leading to server-side request forgeryhttps://agentprime.io/advisories/CVE-2026-88809/https://agentprime.io/advisories/CVE-2026-88809/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 16:03:20 GMTCVECVE-2026-74759: Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentialshttps://agentprime.io/advisories/CVE-2026-74759/https://agentprime.io/advisories/CVE-2026-74759/Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 16:43:14 GMTCVEsignalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcherhttps://agentprime.io/advisories/GHSA-7wpf-ch8f-5f4x/https://agentprime.io/advisories/GHSA-7wpf-ch8f-5f4x/signalk-server >=2.28.0-beta.2, <2.34.0, fixed in 2.34.0. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 30 Oct 2026 22:57:37 GMTnpmsignalk-serverNationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571https://agentprime.io/advisories/GHSA-c6q7-wqw2-h65w/https://agentprime.io/advisories/GHSA-c6q7-wqw2-h65w/gov.nsa.emissary:emissary <8.51.0, fixed in 8.51.0. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 30 Oct 2026 22:51:19 GMTMavengov.nsa.emissary:emissaryCVE-2026-63184: Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusionhttps://agentprime.io/advisories/CVE-2026-63184/https://agentprime.io/advisories/CVE-2026-63184/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 21:49:06 GMTCVECVE-2026-119343: Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file readhttps://agentprime.io/advisories/CVE-2026-119343/https://agentprime.io/advisories/CVE-2026-119343/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 20:31:48 GMTCVECVE-2026-119342: Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypasshttps://agentprime.io/advisories/CVE-2026-119342/https://agentprime.io/advisories/CVE-2026-119342/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 20:28:30 GMTCVECVE-2026-116252: pgAdmin 4: Materialized view refresh redirects its connection through a crafted database namehttps://agentprime.io/advisories/CVE-2026-116252/https://agentprime.io/advisories/CVE-2026-116252/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:20 GMTCVE