#SSRF
All CosmicBytez Labs articles tagged #SSRF, across news, security advisories, how-to guides, and projects.
- News
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
A maximum-severity SSRF flaw (CVE-2026-102255, CVSS 10.0) in SonicWall SMA 1000 appliances is under active attack days after patching.
- Security
CVE-2026-102095: Critical Unauthenticated SSRF in Kiteworks Email Protection Gateway
CVSS 9.1 unauthenticated SSRF lets crafted email content make Kiteworks's gateway fetch internal URLs; fixed before version 9.5.0.
- Security
CVE-2026-102102: Critical Unauthenticated SSRF in Kiteworks Email Protection Gateway
Unauthenticated SSRF (CVSS 9.1) in Kiteworks Email Protection Gateway lets attackers force the gateway to fetch internal resources via certificate validation.
- Security
CVE-2025-56563: Server-Side Request Forgery in Zenith Satellite Tracker
Unauthenticated SSRF in Zenith Satellite Tracker 1.0 lets attackers force the server to request internal and cloud metadata endpoints via sat_proxy.php.
- Security
Critical SSRF in GitLab MCP Server Leaks Private Tokens to Attackers
CVE-2026-61559 lets attackers redirect @zereight/mcp-gitlab's outbound API calls via a request header, leaking victim GitLab tokens to attacker hosts.
- News
Attackers Chain Two New Zero-Days in SonicWall's Besieged SMA 1000
CVE-2026-83548 and CVE-2026-83549 chain into unauthenticated RCE on SonicWall SMA 1000 — the fifth SMA 1000 KEV entry since December.
- News
Attackers Chain Two SonicWall SMA 1000 Zero-Days in Active Attacks
SonicWall confirms active exploitation of two chained SMA 1000 zero-days — a pre-auth SSRF (CVSS 10.0) and post-auth command injection.
- News
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE
SonicWall confirms active exploitation of a chained SSRF and OS command injection pair in SMA 1000 appliances, its third such attack chain in a year.
- Security
Total Processing Card Payments for WooCommerce: Unauthenticated SSRF Enables Payment Verification Forgery
CVE-2026-16947 (CVSS 9.1) lets attackers redirect payment verification requests and forge success responses on WooCommerce stores.
- Security
Icollect Data Collection & Publishing Plugin: Hardcoded Secret Enables Unauthenticated Arbitrary File Read
CVE-2026-77012 (CVSS 9.3) lets unauthenticated attackers read server files via a WordPress plugin's default publishing secret.
- Security
CVE-2026-59354: Spring Security OAuth2 Authorization Server Dynamic Client Registration Flaw
Critical flaw (CVSS 9.6) in Spring Security Authorization Server 7.0.0-7.0.4 lets a registered client trigger stored XSS, SSRF, or privilege escalation.
- Security
CVE-2026-62316: Microsoft UFO MCP Server DNS Rebinding and SSRF via Missing Host Validation
CVSS 8.8: Microsoft's UFO framework MCP server binds to localhost but skips Host/Origin header checks, enabling DNS rebinding and SSRF attacks. Fixed in 3.0.8.
- Security
CVE-2026-78003: Critical SSRF via Path Traversal in Mailgun for WordPress Plugin
A critical SSRF vulnerability (CVSS 9.8) in Mailgun for WordPress ≤ 2.2.0 lets unauthenticated attackers make server-side requests via path traversal.
- News
CISA Warns of Hackers Exploiting Critical MLflow Vulnerability
CVE-2026-64849 (CVSS 9.3): Active SSRF exploitation in MLflow lets attackers steal AWS cloud credentials via redirect bypass. Added to CISA KEV.
- Security
CVE-2026-64849: MLflow SSRF Webhook Bypass Actively Exploited
Critical unauthenticated SSRF in MLflow's webhook system lets attackers redirect requests to steal AWS credentials. Upgrade to 3.15.0.
- Security
CVE-2026-19516: SSRF in mcp-grafana Allows Arbitrary Outbound Requests
A critical server-side request forgery vulnerability in mcp-grafana lets callers hijack the MCP server's outbound HTTP requests via a caller-supplied...
- Security
CVE-2026-57106: Critical SSRF in SAP Data Quality Enables Unauthenticated Privilege Escalation
A CVSS 10.0 server-side request forgery vulnerability in SAP Data Quality Management allows an unauthenticated attacker to escalate privileges over the...
- Security
CVE-2026-13147: Kirki WordPress Plugin SSRF Allows Unauthenticated Internal Network Scanning
A server-side request forgery vulnerability in the Kirki Customizer Framework WordPress plugin before 6.0.12 allows unauthenticated attackers to make the...
- Security
CVE-2026-55229: Gotenberg SSRF via LibreOffice Bypasses Built-in Protections
A server-side request forgery vulnerability in Gotenberg's LibreOffice conversion endpoint allows crafted documents to silently probe internal network...
- Security
CVE-2026-22874: Gitea SSRF Filter Bypass Exposes Cloud Credentials
Gitea versions through 1.26.2 use an incomplete IP filter that allows authenticated users to reach AWS Instance Metadata, Azure WireServer, and...
- Security
CVE-2026-45499: Azure OpenAI SSRF Enables Privilege Escalation — CVSS 9.9
A critical server-side request forgery vulnerability in Azure OpenAI rated CVSS 9.9 allows an authorized attacker to escalate privileges over the network,...
- News
CVE-2026-20230: Cisco Unified CM WebDialer SSRF Now Exploited in the Wild
Cisco Unified Communications Manager and SME are under active attack via CVE-2026-20230, a high-severity SSRF flaw in the WebDialer component that can...
- Security
scalar/astro Proxy Endpoint Unauthenticated SSRF
A critical CVSS 9.8 Server-Side Request Forgery vulnerability in scalar/astro v0.1.13 allows unauthenticated attackers to force the backend server to make...
- News
LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure
A high-severity SSRF vulnerability in LMDeploy, a widely used open-source LLM deployment toolkit, was actively exploited in the wild less than 13 hours...
- Security
Typecho 1.3.0 Pingback SSRF via X-Pingback Manipulation
A CVSS 7.3 server-side request forgery vulnerability in Typecho up to 1.3.0 allows attackers to manipulate the X-Pingback/link argument in Service.php to...
- Security
CVE-2026-32210: Microsoft Dynamics 365 Online SSRF Enables
A critical server-side request forgery vulnerability in Microsoft Dynamics 365 (Online) allows an unauthenticated remote attacker to perform spoofing over...
- Security
CVE-2026-26135: Azure Custom Locations SSRF Enables
A critical server-side request forgery vulnerability in Azure Custom Locations Resource Provider allows an authorized attacker to elevate privileges over...
- Security
CVE-2026-34162: FastGPT Unauthenticated HTTP Proxy Enables
A maximum-severity vulnerability in FastGPT AI agent platform exposes an unauthenticated HTTP proxy testing endpoint that accepts arbitrary user-supplied...
- Security
CVE-2026-5016: elecV2P SSRF Vulnerability in URL Handler
A server-side request forgery vulnerability in elecV2P up to version 3.8.3 allows remote attackers to manipulate the eAxios function via the /mock...
- Security
CVE-2025-12886: Oxygen Theme SSRF Allows Unauthenticated
A Server-Side Request Forgery vulnerability in the Oxygen Theme plugin for WordPress (all versions up to 6.0.8) enables unauthenticated attackers to make...
- Security
CVE-2026-25534: Spinnaker SSRF via URL Validation Bypass
A critical SSRF vulnerability (CVSS 9.1) in Spinnaker's clouddriver and orca components bypasses the previous CVE-2025-61916 URL validation patch through...
- Security
Microsoft Exchange Server SSRF to RCE Chain Actively
A server-side request forgery vulnerability in Exchange Server is being chained with deserialization flaws for unauthenticated remote code execution....