Do Son A critical server-side request forgery flaw in the AWS Systems Manager Agent allows IAM credential theft. Patch your AWS Systems Manager Agent immediately.
Server-Side Request Forgery
Apache released version 1.21.0 to patch critical Apache Allura security vulnerabilities. Update now to protect against XSS, SSRF, and data exposure flaws.
Three Next.js vulnerabilities (CVE-2026-64645, CVE-2026-64649, CVE-2026-64642) enable Server-Side Request Forgery and middleware bypass. Patch now.
CVE-2026-15378 is a blind SSRF in Red Hat OpenShift AI. The guardrails-detectors flaw exposes cloud credentials and Kubernetes secrets.
CVE-2026-33626: A critical SSRF in LMDeploy exploited in under 13 hours. Learn how attackers hijack AI nodes and how to secure your inference cloud now.
Angular patches a critical 9.2 CVSS SSRF vulnerability (CVE-2026-27739). Attackers can manipulate Host headers to steal credentials and probe internal networks.
Zimbra issued an emergency patch (v10.1.12) for a Critical SSRF vulnerability in the chat proxy that lets attackers manipulate internal server requests. Update is urged immediately.
A critical SSRF vulnerability (CVE-2025-54381) in BentoML's file upload handling allows unauthenticated remote attackers to perform internal network reconnaissance and steal cloud metadata credentials from AI applications.
A critical unauthenticated SSRF vulnerability (CVE-2025-54122, CVSS 10.0) in Manager.io's accounting software allows bypassing network isolation and exfiltrating sensitive data from cloud environments.
JPCERT/CC warns of critical flaws in Nimesa Backup and Recovery (CVE-2025-48501, CVSS 9.8 RCE; CVE-2025-53473 SSRF). Unsupported versions pose severe risk to AWS data.
A critical SSRF flaw (CVE-2025-6087) in @opennextjs/cloudflare allows unauthenticated users to proxy arbitrary remote content via /_next/image endpoint.
A critical SSRF vulnerability (CVE-2025-32013) has been patched in LNbits, the Lightning Network wallet server. Learn how attackers could exploit LNURL authentication to access internal services and how to protect your systems.
Learn about a critical vulnerability in Veeam Backup for Microsoft Azure (CVE-2025-23082) and its potential impact on network security.
Discover the CVE-2024-53353 vulnerability in Invoice Ninja that could allow attackers to access sensitive files.
Understanding the CVE-2024-55875 vulnerability in the http4k toolkit: risks, impacts, and ways to mitigate this critical XXE Injection vulnerability.
CVE-2024-38472 (Important): Server-Side Request Forgery (SSRF) vulnerability on Windows systems, potentially leaking sensitive NTML hashes
A significant security vulnerability has been uncovered in the widely-used node-ip npm package, which is designed to...
Recent discoveries have exposed CVE-2024-34350 & CVE-2024-34351 which could compromise user data and server operations
CVE-2024-29190 allows attacker to trick the MobSF server into making requests to internal or otherwise inaccessible resources within your network
Another critical vulnerability, identified as 'GHSA-76cc-p55w-63g3', was found in Teleport's version 14 access list feature