All CosmicBytez Labs articles tagged #SSRF, across news, security advisories, how-to guides, and projects.
CVE-2026-16947 (CVSS 9.1) lets attackers redirect payment verification requests and forge success responses on WooCommerce stores.
CVE-2026-77012 (CVSS 9.3) lets unauthenticated attackers read server files via a WordPress plugin's default publishing secret.
Critical flaw (CVSS 9.6) in Spring Security Authorization Server 7.0.0-7.0.4 lets a registered client trigger stored XSS, SSRF, or privilege escalation.
CVSS 8.8: Microsoft's UFO framework MCP server binds to localhost but skips Host/Origin header checks, enabling DNS rebinding and SSRF attacks. Fixed in 3.0.8.
A critical SSRF vulnerability (CVSS 9.8) in Mailgun for WordPress ≤ 2.2.0 lets unauthenticated attackers make server-side requests via path traversal.
CVE-2026-64849 (CVSS 9.3): Active SSRF exploitation in MLflow lets attackers steal AWS cloud credentials via redirect bypass. Added to CISA KEV.
Critical unauthenticated SSRF in MLflow's webhook system lets attackers redirect requests to steal AWS credentials. Upgrade to 3.15.0.
A critical server-side request forgery vulnerability in mcp-grafana lets callers hijack the MCP server's outbound HTTP requests via a caller-supplied X-Grafana-URL header, enabling SSRF attacks against internal and external hosts.
A CVSS 10.0 server-side request forgery vulnerability in SAP Data Quality Management allows an unauthenticated attacker to escalate privileges over the...
A server-side request forgery vulnerability in the Kirki Customizer Framework WordPress plugin before 6.0.12 allows unauthenticated attackers to make the...
A server-side request forgery vulnerability in Gotenberg's LibreOffice conversion endpoint allows crafted documents to silently probe internal network...
Gitea versions through 1.26.2 use an incomplete IP filter that allows authenticated users to reach AWS Instance Metadata, Azure WireServer, and...
A critical server-side request forgery vulnerability in Azure OpenAI rated CVSS 9.9 allows an authorized attacker to escalate privileges over the network,...
Cisco Unified Communications Manager and SME are under active attack via CVE-2026-20230, a high-severity SSRF flaw in the WebDialer component that can...
A critical CVSS 9.8 Server-Side Request Forgery vulnerability in scalar/astro v0.1.13 allows unauthenticated attackers to force the backend server to make...
A high-severity SSRF vulnerability in LMDeploy, a widely used open-source LLM deployment toolkit, was actively exploited in the wild less than 13 hours...
A CVSS 7.3 server-side request forgery vulnerability in Typecho up to 1.3.0 allows attackers to manipulate the X-Pingback/link argument in Service.php to...
A critical server-side request forgery vulnerability in Microsoft Dynamics 365 (Online) allows an unauthenticated remote attacker to perform spoofing over...
A critical server-side request forgery vulnerability in Azure Custom Locations Resource Provider allows an authorized attacker to elevate privileges over...
A maximum-severity vulnerability in FastGPT AI agent platform exposes an unauthenticated HTTP proxy testing endpoint that accepts arbitrary user-supplied...
A server-side request forgery vulnerability in elecV2P up to version 3.8.3 allows remote attackers to manipulate the eAxios function via the /mock...
A Server-Side Request Forgery vulnerability in the Oxygen Theme plugin for WordPress (all versions up to 6.0.8) enables unauthenticated attackers to make...
A critical SSRF vulnerability (CVSS 9.1) in Spinnaker's clouddriver and orca components bypasses the previous CVE-2025-61916 URL validation patch through...
A server-side request forgery vulnerability in Exchange Server is being chained with deserialization flaws for unauthenticated remote code execution....