high7.1
CVE-2026-63184
Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion
christianhelle · refitter
Your agent Now with CVE context
Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV
Find vulnerabilities that affect you.
Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Severity
142 matching advisories · 30 shown
Follow substantive record changes →SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium6.8
CVE-2026-119343
Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read
Stirling-Tools · Stirling-PDF
medium5.3
CVE-2026-119342
Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass
Stirling-Tools · Stirling-PDF
high7.1
CVE-2026-116252
pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name
pgadmin.org · pgAdmin 4
critical9.1
CVE-2026-55598
PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
madeofpendletonwool · PinePods
high8.6
CVE-2026-62284
OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
osac-project · osac-operator
low2.3
CVE-2026-61840
Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services
vantern-org · questbot
medium6.4
CVE-2026-119712
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
pipeshub-ai · pipeshub-ai
medium6.9
CVE-2026-119709
Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata
goniszewski · grimoire
low3.1
CVE-2026-100355
Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard
basecamp · once-campfire
high7.1
CVE-2026-119575
ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
ArcadeData · arcadedb
low2.7
CVE-2026-101209
Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability.
Dell · OpenManage Enterprise
high7.1
CVE-2026-119549
Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
jellyfin · jellyfin
medium6.9
CVE-2026-119545
Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
forgejo · forgejo
medium6.3
CVE-2026-119428
phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
phpMyAdmin · phpMyAdmin
high8.7
CVE-2026-13303
Boundary vulnerable to server-side request forgery in Vault credential store
HashiCorp · Boundary / HashiCorp · Boundary Enterprise
medium6.1
CVE-2026-118766
Botan: Online OCSP redirects enable blind requests to internal HTTP services
randombit · botan
medium6.9
CVE-2026-119122
Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
unclecode · crawl4ai
medium5.0
medium4.3
medium4.3
medium5.4
medium5.3
medium5.5
CVE-2026-118989
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects
WebToffee · Product Import Export for WooCommerce
medium4.8
CVE-2026-71569
Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name
Apache Software Foundation · Apache Camel
high7.5
CVE-2026-111418
SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service
Foxit Software Inc. · foxit.com
medium6.9
CVE-2026-118586
dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery
dfm · feedfinder2
high7.5
CVE-2026-118577
maotoumao MusicFreeDesktop Request Forwarder server-side request forgery
maotoumao · MusicFreeDesktop
high8.6
CVE-2026-61572
AVideo-Encoder: unauthenticated full-response server-side request forgery
WWBN · AVideo-Encoder
medium6.2