CVE-2026-108583

zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zotero_add_by_url, causing requests to loopback, private, or link-local hosts directly or via redirects, leaking citation meta-tags and error details.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-108523

Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: "Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification."

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Studio-saelix

Products

Sencho

CVE-2026-108115

Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses

Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Kortix-ai

Products

Suna

CVE-2026-102138

Kiteworks Core Server-Side Request Forgery (SSRF)

An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation requires the licensed gateway role to be active.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Core

CVE-2026-18382

Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Cost Management Metrics Operator Cost Management Cost Management Metrics Operator

CVE-2026-18381

Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Cost Management Metrics Operator Cost Management Cost Management Metrics Operator

CVE-2026-18378

Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Cost Management Metrics Operator Cost Management Cost Management Metrics Operator

CVE-2026-93694

Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL, this behavior together with a race condition allows the attacker to cause FileCopyService to consume attacker-controlled metadata and content. Exploitation requires control over copy queue work and a race condition.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Sharefile Storage Zones Controller

CVE-2026-93693

Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remote unauthenticated attacker to issue server-side requests to unintended local handlers and perform unauthorized queue operations.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Sharefile Storage Zones Controller

CVE-2026-100251

Wormhole.app SSRF

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wormhole App

Products

Wormhole

CVE-2026-98293

Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() iso_get_sock() returns the parent socket with a reference held, which is dropped by sock_put() once the child socket has been set up. The error path taken when iso_sock_alloc() fails only calls release_sock() and returns, leaking the reference and thus the parent socket itself. Drop the reference on that path as well.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-101022

Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Grid Protection Alliance

Products

Openhistorian Openpdc

CVE-2026-62030

WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-27350

WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Builderius.io

Products

Builderius

CVE-2026-98344

dmaengine: Fix device kref underflow in dma_chan_put()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dma_chan_put() dma_chan_get() takes chan->device->ref only on the slow path: /* no kref on fast path */ if (chan->client_count) { __module_get(owner); chan->client_count++; return 0; } if (!try_module_get(owner)) return -ENODEV; if (!dma_device_get(chan->device)) { // calls kref_get_unless_zero() dma_chan_put() drops the ref unconditionally, so every fast-path get/put pair drops one extra device reference. The bug fires when two conditions hold together: a non-private provider has a persistent client holding chan->client_count > 0 and another client cycles dmaengine_get()/dmaengine_put(). When the kref hits zero, the subsequent dma_find_channel() returns NULL even though the provider module is still loaded. Fix this by dropping device->ref only on the last put, matching the single slow-path get.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-103958

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafted connection address supplied when registering, updating or testing a tool server or remote agent. To remediate this issue, users should upgrade to version 1.7.0 or later.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Loom

CVE-2026-103957

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Loom

CVE-2026-107394

Indico: Incomplete Server-Side Request Forgery (SSRF) check

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is accepted as valid by Indico. The organizer can read data returned by the target through affected Indico features. This issue is fixed in version 3.3.13.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Indico

Products

Indico

CVE-2026-96890

Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Github

Products

Enterprise Server

CVE-2026-107781

Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Dromara

Products

Skyeye