search
SSRF
Trends
- 1
SAP has issued a warning about a maximum severity security flaw involving server-side request forgery (SSRF) in its OAuth2 implementation. The vulnerability, rated critical, could allow attackers to make unauthorized requests from vulnerable systems. Security teams are urged to review SAP's advisory and apply patches promptly.
- 2Critical SonicWall vulnerability exploited days after disclosure▼⚠️ CRITICAL: Critical SonicWall Vulnerability Exploited Days After Disclosure A critical pre-authenticated SSRF vulnerab
A critical pre-authentication SSRF vulnerability, tracked as CVE-2026-102255, in SonicWall SMA1000 appliances is being actively exploited in the wild just days after its disclosure. Unauthenticated attackers can abuse the flaw to force the appliances into unintended requests, raising alarm among security researchers who warn administrators to patch immediately.
- 3SonicWall Patches Maximum-Severity Flaw as Exploitation Starts▼SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
SonicWall has released a patch for a server-side request forgery vulnerability rated CVSS 10.0, the highest possible severity, amid reports that attacks targeting the flaw have begun. Security experts are urging customers to apply the fix immediately, warning that unpatched appliances could allow attackers to send unauthorized requests from affected systems.
- 4Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Active Attack●🗞 Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack via Dark Reading https://www. darkreading.com/vulnera
Security researchers report that a maximum-severity server-side request forgery (SSRF) vulnerability affecting SonicWall SMA secure mobile access appliances is now being actively exploited in the wild. Dark Reading covered the development, warning administrators to patch affected devices immediately. The flaw could let attackers reach internal network resources, and defenders are urging rapid mitigation as exploitation attempts increase.
- 5French CAPTCHA provider Captcha.eu flagged over unpatched SSRF flaws●Captcha.eu (France) carries a C trust score with 100% of its 2 CVEs unpatched, including CWE-918 SSRF at CVSS 7.1. No CI
French bot-defense vendor Captcha.eu is drawing scrutiny over a low trust score, with both of its known CVEs reportedly unpatched, including a server-side request forgery flaw (CWE-918) rated 7.1 on the CVSS scale. Security commentary warns that an open SSRF issue in a component designed to block bots warrants assessment before websites embed the service, though neither vulnerability appears in CISA's known exploited vulnerabilities catalog.
- 6SonicWall SMA 1000 critical flaw hit by 135 exploitation attempts●⚠️ CRITICAL: Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch SonicWall SMA 1000 appli
Attackers are actively targeting a critical pre-authenticated SSRF vulnerability, tracked as CVE-2026-102255, in SonicWall SMA 1000 appliances, with 135 exploitation attempts recorded despite a patch already being available. Security observers are urging administrators to update affected devices immediately, warning that unpatched appliances remain exposed to takeover and network pivoting.
- 7SonicWall scrambles to patch actively exploited VPN flaw●SonicWall patched a max-severity flaw in its SMA1000 VPN gateways on Oct 6. Honeypots saw exploitation a day later. CVE-
SonicWall patched a maximum-severity vulnerability, CVE-2026-102255, in its SMA1000 VPN gateways on October 6. The flaw, a CVSS 10 pre-authentication SSRF with no workaround, was exploited in the wild just a day after the fix, as confirmed by honeypot detections. Security researchers are urging all organisations running SMA1000 appliances to apply the patch immediately, since exploitation requires no credentials and leaves unpatched devices wide open to attackers.
- 8WWBN AVideo flagged with unpatched CVEs, max CVSS 9.4●Wwbn avideo scores D on trust: 3 CVEs, max CVSS 9.4, and 100% still unpatched. Two SSRF flaws lead the list. Patch your
Security researcher Hugo Valters reports that WWBN's AVideo platform scores a D on his trust rating, with three CVEs carrying a maximum CVSS score of 9.4 and all three still unpatched. Two server-side request forgery flaws lead the list. He advises operators to patch their deployments or move to an alternative platform.
- 9Critical SSRF vulnerability disclosed in Microsoft Azure SRE Agent●CVE-2026-69435: CRITICAL SSRF (CVSS 9.6) in Microsoft Azure SRE Agent. Missing authorization controls let authorized att
A new vulnerability, CVE-2026-69435, has been disclosed in Microsoft's Azure SRE Agent with a critical severity score of 9.6. The server-side request flaw stems from missing authorization controls, letting authorized attackers escalate privileges and potentially compromise confidentiality and integrity. Microsoft has already issued a fix, and security researchers are circulating details so defenders can patch affected deployments quickly.
- 10SonicWall Patches Critical Flaws in SMA 1000 Appliances●SonicWall Patches Critical Pre-Auth SSRF in SMA 1000 Series Appliances SonicWall patched four vulnerabilities in its SMA
SonicWall has released patches for four vulnerabilities in its SMA 1000 series secure access appliances, including a critical pre-authentication SSRF flaw tracked as CVE-2026-102255 with a maximum CVSS score of 10.0. The flaws could let unauthenticated attackers target the appliances remotely, making rapid patching urgent for administrators.