tag
Cloud-Metadata
High
Typebot Unauthenticated Preview-Chat SSRF — CVE-2026-33712
CVE-2026-33712·
Typebot (open-source chatbot builder), preview chat endpoint
patched
Critical
Plunk SSRF via Unvalidated AWS SNS SubscriptionConfirmation — CVE-2026-32096
CVE-2026-32096·
Plunk (useplunk/plunk) email/webhook API
unpatched
High
pdfmake Server-Side Request Forgery via Unvalidated Document URLs (CVE-2026-26801)
CVE-2026-26801·
pdfmake (Node.js PDF generation library), src/URLResolver.js
patched
Critical
MagicMirror² Unauthenticated SSRF via `/cors` Endpoint (CVE-2026-42281)
CVE-2026-42281·
MagicMirror²
patched
High
Kan SSRF via Attachment Download Endpoint — CVE-2026-32255
CVE-2026-32255 (GHSA-qrx8-9hc6-jvqg)·
Kan (kanbn/kan) open-source project management tool
patched
High
Apache Flink Kubernetes Operator SSRF via jarURI (CVE-2026-40564)
CVE-2026-40564·
Apache flink-kubernetes-operator
unpatched