Apache Batik has a moderate SSRF flaw (CVE-2026-44929)
Simon Steiner posted the moderate-severity issue on November 11, with links to the CVE and BATIK-1393.
Stories per day · 30 days
6 RSS
Relatedplex6kev5zdi5apache4cisa3information-disclosure3mlflow3rce3axis22command-injection2cryptominer2cve-2026-350292cve-2026-598232cve-2026-891112litellm2llm-gateway2oauth22oracle2
92 stories, newest first · one card per story
Stories tagged #ssrf
Adobe patches about 110 flaws across nine products
Six Adobe Connect issues score CVSS 10, and Adobe says it knows of no attacks on the new fixes.
Hackers use public Plex2Shell chain to hijack Plex servers and install miners
Four unauthenticated flaws, added to CISA’s KEV on October 20, run code as the Plex service; fixed in 1.43.3.10861.
1
Apache Axis2/Java SSRF via WSDL/XSD schema import resolution
Apache Axis2/Java before 2.0.2 allows SSRF when building service descriptions from WSDL through unrestricted fetching of absolute URLs in wsdl:import and xsd:import/include locations.
Home Assistant Green aiohttp_client SSRF disclosed from Pwn2Own
ZDI rates CVE-2026-91131 at CVSS 5.4; network-adjacent attackers need no authentication.
Rancher meta proxy allowlist bypass leads to server-side request forgery (SUSE AV26-1113)
Rancher versions prior to 2.11.19, 2.12.15, 2.13.11, 2.14.7 and 2.15.3 are affected by the vulnerability.
Google::Auth for Perl (2 CVEs)
Affects versions 0.11 through 0.12; no fixed versions or exploitation stated.
HashiCorp Nomad symlink escape and Boundary SSRF disclosed
Nomad dispatch writes can leave the allocation directory via symlinks, and Boundary has SSRF in its Vault credential store.
Unauthenticated MLflow get-artifacts SSRF leaks data (CVE-2026-118628)
ZDI rates the flaw 8.2; the snippet gives no affected versions, fix, or exploitation status.
Unauthenticated SSRF in Cisco Finesse exposes limited internal data
Cisco rates CVE-2026-20362 at 7.2 and says no fixes exist yet, with first patches planned for 2027.
ShinyHunters PeopleSoft zero-day is three flaws under CVE-2026-35273
Unauthenticated SSRF to the loopback-trusted admin hub yields code execution on PeopleTools 8.61 and 8.62.
1
ShinyHunters mass-exploits PeopleSoft SSRF-to-RCE bug CVE-2026-35273
A gateway request forgery can satisfy localhost trust checks and reach a file-write path to code execution.
3
Roundcube webmail fixes injection, XSS and SSRF flaws
Versions 1.6.20 and 1.7.5, released October 19, fix IMAP command injection via CRLF plus XSS and SSRF issues.
Apache Cocoon XEE flaw can enable SSRF and file disclosure
The retired project’s form processor is affected in every version, and the report names no fixed release.
Incomplete security patches rose about eightfold in 2026
KEV fixes were later reported broken about four times as often as other fixes from the same vendors.
1
CISA adds six exploited vulnerabilities to the KEV catalog
The entries cover four Plex Media Server bugs, SiteGuard command injection, and a Siemens path flaw.
CISA adds Plex Media Server SSRF to KEV (CVE-2026-96652)
Any X-Plex-Token can force a POST via /player/timeline on builds before 1.43.3.10861; the due date is November 3.
Fixed Plex Media flaws exploited to install malware
The public chain uses unauthenticated SSRF, a loopback pivot, and token theft to run a payload.
Terra says GitHub patch-failure share rose from 0.2% to 2.3%
Fixes later bypassed were about four times as likely to appear on CISA's KEV list as other bugs from the same vendors.
1
Attackers exploit Plex Media Server flaws to install cryptominers
A public four-CVE Plex2Shell chain hit a Linux Docker honeypot on October 17, 2026, and also dropped proxy software.
4
CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF
Apache Kylin 4.0.0 through 5.0.4 has a moderate job-driver SSRF flaw, fixed in 5.0.5.
CISA Malcolm
CISA patched high-severity Malcolm flaws through version 26.08.0, including authentication bypass and SSRF.
Warning Over High-Risk Vulnerabilities in Widely Used LLM Gateway Tool
Check Point warns LiteLLM flaws CVE-2026-35029 and CVE-2026-59823 can give any user admin access and code execution.
7
CVE-2026-89111: Critical SAP Cloud SDK SSRF
SAP disclosed CVE-2026-89111, a CVSS 10 SSRF in SAP Cloud SDK for Python that can leak OAuth2 secrets.
3