🎯 SSRF

The items that name it 84

• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
  articleas classification.key entities2026-10-29
• The Rise of Agentic Attacks: What They Look Like, and Where They're Headed
  writeupas classification.key entities2026-10-29
• CVE-2026-20362 | Cisco Finesse Server-Side Request Forgery Vulnerability
  advisoryas classification.key entities2026-10-28
• Atlassian Patches 75 Flaws in Data Center and Server Products
  articleas classification.key entities2026-10-23
• How bug bounty sharpens one researcher’s security skills
  articleas classification.key entities2026-10-22
• Plex vulnerabilities being exploited in the wild to drop a cryptominer
  writeupas classification.key entities2026-10-19
• Dark Web Intelligence (@DailyDarkWeb) on X
  threadas classification.key entities2026-10-18
• Mikko Laakkonen (@mikkolaakkonen) on X
  threadas techniques2026-10-17It is written here as Server-side request forgery (user-supplied URLs reaching internal services or cloud metadata).

  user-supplied URLs reaching internal services or cloud metadata

• AWS Security Agent (now part of AWS Continuum) exploited 33 of 37 new real-world CVEs
  articleas classification.key entities2026-10-15
• [tl;dr sec] #350 - Reverse Engineer Anything, Tracking AI-integrated Malware, Test-driving Jev
  articleas classification.key entities2026-10-15
• Dark Web Informer (@DarkWebInformer) on X
  threadas classification.key entities2026-10-14
• SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities
  articleas classification.key entities2026-10-14
• Dark Web Intelligence (@DailyDarkWeb) on X
  advisoryas classification.key entities2026-10-13
• Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
  advisoryas techniques2026-10-13It is written here as Server-Side Request Forgery (Azure SRE Agent).

  Azure SRE Agent

• ZDI: The October 2026 Security Update Review
  advisoryas classification.key entities2026-10-13
• Dark Web Informer (@DarkWebInformer) on X
  threadas classification.key entities2026-10-13
• Critical SonicWall Vulnerability Exploited Days After Disclosure
  articleas classification.key entities2026-10-12
• lee1981 (@lee1981b) on X
  advisoryas classification.key entities2026-10-09
• Cisco Patches a Dozen Critical Vulnerabilities
  articleas classification.key entities2026-10-08
• AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security Model
  writeupas classification.key entities2026-10-08
• SonicWall and Splunk Patch Critical Vulnerabilities
  articleas classification.key entities2026-10-08
• Frontier models found the vulnerabilities. Only the attacker found the chains.
  articleas classification.key entities2026-10-07
• Why AI Coding Agents Keep Writing Broken Access Control
  articleas techniques2026-10-01It is written here as Server-Side Request Forgery (SSRF).

  cited as a CWE within A01:2025 Broken Access Control category that has a traceable shape detectable by static analysis

• Vulnerability Discovery and Exploitation Trends in the AI Era (Google Cloud)
  articleas techniques2026-09-30It is written here as Server-Side Request Forgery (SSRF).

  Nearly a quarter (24%) of AI backend serving infrastructure flaws (vLLM, Triton, LiteLLM, Ollama) stem from unauthenticated API endpoints or SSRF, allowing adversaries to bypass firewalls, exhaust GPU compute, or extract model checkpoints.

• https://github.com/dmdhrumilmistry/security-harness
  repoas classification.key entities2026-09-29
• Agentic Hacks, Real Proofs: Inside Google's PageBreak Project
  articleas classification.key entities2026-09-24
• ICYMI: August 2026 @AWS Security
  articleas techniques2026-09-23

  issue category affecting OpenSearch

• https://github.com/akha-security/akca
  repoas classification.key entities2026-09-23
• VIPER-MCP: Detecting Vulnerabilities in MCP Servers
  paperas techniques2026-09-17It is written here as SSRF (CWE-918).

  Tool arguments influence outbound request URLs, allowing internal network scanning or data exfiltration.

• AI Agent Hacking Writeups
  repoas techniques2026-09-17It is written here as SSRF (Server-Side Request Forgery).

  Server-Side Request Forgery

• shinthink/blitzstrike
  repoas classification.key entities2026-09-12
• Metasploit Wrap Up: This One Goes to Sixteen!
  articleas techniques2026-09-11It is written here as Server-Side Request Forgery (SSRF).

  Used in SonicWall SMA1000 exploit chain to bypass authentication

• The state of AI for security: Measuring what matters most for building trust
  articleas classification.key entities2026-09-09
• Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
  advisoryas techniques2026-09-08It is written here as Server-Side Request Forgery (SSRF).

  SSRF

• Top MCP Security Resources — September 2026 (Adversa.ai)
  articleas techniques2026-09-07It is written here as SSRF (Server-Side Request Forgery).

  Facebook-ads-mcp-server's fetch_pagination_url function allows driving requests from the server's network position (CVE-2026-19956); also SSRF against cloud metadata services found in the 'Exposed by design' study.

• eldarshiraliyev/BugScanner
  repoas classification.key entities2026-09-05
• Incident response guide for AWS CloudTrail investigations – Part 2 | Amazon Web Services
  writeupas classification.key entities2026-09-03
• Incident response guide for AWS CloudTrail investigations – Part 1 | Amazon Web Services
  writeupas classification.key entities2026-09-03
• Grafana fixes critical SSRF flaw affecting Grafana MCP servers
  advisoryas techniques2026-09-03It is written here as Server-side request forgery (SSRF).

  Using the "X-Grafana-URL" header with the "grafana_api_request" tool to control HTTP method, path and body of outbound requests, reaching internal services otherwise unreachable

• Awesome Cybersecurity Agentic AI
  repoas techniques2026-08-31
• When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog
  articleas classification.key entities2026-08-26
• Cybermes
  repoas techniques2026-08-23

  Referenced as part of web vulnerability playbooks

• Deep Eye
  repoas techniques2026-08-22

  Vulnerability check performed by the scanner

• MinIO Security Lab
  repoas classification.key entities2026-08-21
• Teycir/BurpAPISecuritySuite
  repoas techniques2026-08-21It is written here as SSRF (Server-Side Request Forgery).

  Internal IP targeting, cloud metadata access, DNS rebinding

• What is an agent harness? The software that turns a model into an agent | Blog | Endor Labs
  articleas techniques2026-08-15It is written here as Server-side request forgery (SSRF).

  classic bug shown up in real MCP servers

• DocsGPT Security Hardening Playbook
  writeupas techniques2026-08-15It is written here as SSRF (Server-Side Request Forgery).

  Attack vector targeting the cloud-metadata endpoint, mitigated via NetworkPolicy

• Dark-Moon
  repoas techniques2026-08-05It is written here as Server-side request forgery (ssrf).

  Focus area selectable via FOCUS flag

• Recon-Skills
  repoas techniques2026-07-29It is written here as SSRF (referenced via search example).

  referenced via search example

• Using Claude’s Security Review Skill in Claude Code
  articleas classification.key entities2026-07-29
• The risk hiding behind exposed MCP servers
  writeupas classification.key entities2026-07-28
• BountyForge
  repoas techniques2026-07-22

  Payload coverage

• Gabson0x/pentdem
  repoas techniques2026-07-20

  Server-Side Request Forgery vulnerability hunting; also pivoted to cloud metadata exploitation

• AI-Assisted Vulnerability Management
  articleas techniques2026-07-18It is written here as Server-side request forgery (indirect SSRF).

  Vulnerability class requiring understanding of business context and cross-service trust boundaries

• Strix
  repoas techniques2026-07-15

  Server-side vulnerability tested by Strix

• Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days Being Actively Exploited (CVE-2026-15409, CVE-2026-15410)
  writeupas classification.key entities2026-07-15
• AI Security Briefing
  advisoryas techniques2026-07-13It is written here as SSRF (Server-Side Request Forgery).

  Unauthenticated SSRF via attacker-controlled X-Atlassian-{Jira,Confluence}-Url header, reaching cloud metadata (169.254.169.254) or internal services

• awesome-ai-security-tools
  repoas techniques2026-07-11It is written here as SSRF (server-side request forgery).

  server-side request forgery

• One Request to Own Every Repo: How We Hijacked GitLab Through Its MCP Server - Pluto Security
  writeupas classification.key entities2026-07-06
• Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?
  writeupas techniques2026-06-29It is written here as SSRF (Server-Side Request Forgery).

  High-signal exploit shape often found cleanly by model configurations.

• RAPTOR
  repoas techniques2026-06-28

  Covered by Semgrep rules; annotation-driven framework SSRF (Spring @RequestParam, FastAPI typed params) listed as coverage gap

• Armur-Ai/Pentest-Swarm-AI
  repoas techniques2026-06-21It is written here as SSRF (Server-Side Request Forgery).

  Server-Side Request Forgery

• Red Agentの視点：いかにして推論を重ねてSSRFへと至ったか
  writeupas classification.key entities2026-06-17
• レッドエージェント POVシリーズのご紹介
  articleas techniques2026-06-17It is written here as SSRF (Server-Side Request Forgery).

  Discovered in a GCP Cloud Run service via a URL parameter restricted to GitHub links; bypass found over 3 scan runs and 96 iterations, escalating to full credential and source code extraction without authentication

• SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
  writeupas classification.key entities2026-06-15
• New attack turned Microsoft 365 Copilot into 1-click data theft tool
  articleas classification.key entities2026-06-15
• Pipelock
  repoas techniques2026-06-14It is written here as SSRF (Server-Side Request Forgery).

  Requests to private/internal addresses or cloud metadata endpoints; blocked via immutable literal-IP SSRF floors and DNS SSRF/rebinding protection, with exceptions for configured MCP upstreams

• ShulkwiSEC/bb-huge
  repoas techniques2026-06-05

  Web security vulnerability category covered by curated skills

• Web LLM Attacks Lab: Exploiting AI agents to trigger secondary vulnerabilities
  videoas techniques2026-06-02It is written here as Server-Side Request Forgery (SSRF).

  SSRF

• elementalsouls/Claude-BugHunter
  repoas techniques2026-05-22

  Server-Side Request Forgery covered by hunt-* skills

• DeepTeam
  repoas techniques2026-05-07

  Server-side request forgery to internal services

• microsoft/AntiSSRF
  repoas techniques2026-05-06It is written here as Server-Side Request Forgery (SSRF).

  Attacker manipulates a server-side application to make network requests to an arbitrary endpoint, potentially exposing internal services, leaking sensitive data, causing service disruption, or leading to remote code execution; can result in token theft when customer-supplied strings used to construc

• Inside mobile taint analysis: how source-to-sink tracking finds real data-leak paths | Oversecured Blog
  articleas classification.key entities
• ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary
  paperas classification.key entities
• santosomar/AI-agents-for-cybersecurity
  repoas classification.key entities
• bilawalsidhu/gods-eye-view
  repoas classification.key entities
• OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
  articleas classification.key entities
• CVE-2026-65056: mcp-webresearch 0
  advisoryas classification.key entities
• CVE-2026-19984: A flaw has been found in jkawamoto mcp-florence2 up to 0
  advisoryas techniquesIt is written here as Server-Side Request Forgery (SSRF).

  Manipulation of the 'src' argument in the get_images function of src/mcp_florence2/__init__.py causes SSRF, exploitable remotely.

• CVE-2026-14748: A flaw has been found in AIAnytime Awesome-MCP-Server up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab
  advisoryas classification.key entities
• DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
  advisoryas classification.key entities
• CISA Adds Seven Known Exploited Vulnerabilities to Catalog | CISA
  advisoryas classification.key entities
• Security Hardening Release for Splunk Apps and Add-ons - August 2026
  advisoryas techniquesIt is written here as Server-Side Request Forgery (SSRF).

  REST API endpoint accepts attacker-controlled destination for authenticated Splunk management requests, used in CVE-2026-76389 and CVE-2026-76402

• Grafana MCP server-side request forgery via X-Grafana-URL header (grafana_api_request) | Grafana Labs
  advisoryas classification.key entities