Curated security research, vulnerabilities, advisories and tools for practitioners.

#ssrf

Security coverage tagged ssrf.

1.

A sandbox is only as closed as what an AI agent can reach

blog | 2026-08-12 00:00 | about.gitlab.com | original ↗ | #ai-security | #zero-day | #gitlab

2.

Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents

blog | 2026-06-25 00:00 | tenzai.com | original ↗ | #ai-security | #appsec | #benchmark

3.

How to Chain Vulnerabilities for RCE: From Image Metadata to Complete System Compromise

research | 2026-06-22 11:46 | hackenproof.com | original ↗ | #rce | #pentesting | #cve

4.

CVE-2026-45502 — Microsoft Exchange Server EWS InstallApp Server-Side Request Forgery

research | 2026-06-22 00:00 | CVE-2026-45502 | aretiq.ai | original ↗ | #cloud | #ssrf | #exchange-server

5.

The Red Agent POV: How it Reasoned its Way to SSRF

blog | 2026-06-17 14:33 | wiz.io | original ↗ | #cloud | #ai-pentesting | #ssrf

6.

Breaking Tenant Boundaries, When Path Traversal Isn't About the Filesystem

blog | 2026-05-26 12:45 | labs.cognisys.group | original ↗ | #data-exposure | #path-traversal | #saas

7.

Server-side request forgery: The ultimate Bug Bounty guide to exploiting SSRF vulnerabilities

blog | 2026-05-12 07:55 | yeswehack.com | original ↗ | #bug-bounty | #cloud | #rce

8.

Otto Support - SSRF and Token Passthrough with MCP

blog | 2026-05-07 00:00 | CVE-2026-27826 | bishopfox.com | original ↗ | #ai-security | #cloud | #rce

9.

Axios CVE-2026-40175: a critical bug that’s… not exploitable

vulnerability | Medium | 2026-04-14 00:00 | CVE-2026-40175 | aikido.dev | original ↗ | #prototype-pollution | #request-smuggling | #cve

10.

Apache Proxy Paradox CVE-2021-40438

vulnerability | 2026-03-06 09:10 | CVE-2021-40438 | labs.cognisys.group | original ↗ | #cloud | #pentesting | #apache

11.

XML external entity: The ultimate Bug Bounty guide to exploiting XXE vulnerabilities

blog | 2026-02-06 17:36 | yeswehack.com | original ↗ | #bug-bounty | #cloud | #rce

12.

Supabase Leaks, What We Found

blog | 2026-02-02 09:10 | labs.cognisys.group | original ↗ | #cloud-security | #pentesting | #account-takeover

13.

Blind trust: what is hidden behind the process of creating your PDF file?

research | 2025-12-29 11:57 | swarm.ptsecurity.com | original ↗ | #appsec | #vulnerability-research | #web-security

14.

Top 10 Web Application Security Vulnerabilities Every Team Should Know

blog | 2025-10-20 00:00 | aikido.dev | original ↗ | #web-security | #xss | #deserialization

15.

The minefield between syntaxes: exploiting syntax confusions in the wild

blog | 2025-10-17 11:30 | yeswehack.com | original ↗ | #bug-bounty | #arbitrary-file-read | #research

16.

CVE-2025-27888: Server-Side Request Forgery via URL Parsing Confusion in Apache Druid Proxy Endpoint

vulnerability | Medium | 2025-09-23 14:42 | CVE-2025-27888 | xbow.com | original ↗ | #zero-day | #vulnerability-research | #ssrf

17.

Cracking the lens: targeting HTTP's hidden attack-surface

research | 2025-09-03 07:38 | portswigger.net | original ↗ | #bug-bounty | #attack-surface | #portswigger

18.

The Quest for the Shortest Domain

blog | 2025-08-19 00:00 | josephthacker.com | original ↗ | #bug-bounty | #automation | #xss

19.

Another Byte Bites the Dust - How XBOW Turned a Blind SSRF into a File Reading Oracle

vulnerability | Critical | 2025-07-28 12:00 | xbow.com | original ↗ | #vulnerability-research | #ssrf | #exfiltration

20.

Chunked-body parsing flaws, making self-XSS great again, using HTTP redirect loops to achieve non-blind SSRFs – ethical hacker news roundup

blog | 2025-07-09 08:14 | yeswehack.com | original ↗ | #cloud | #web-security | #ssrf

21.

Beyond ‘../../’ - a practical guide to path traversal and arbitrary file read attacks

blog | 2025-05-15 12:51 | yeswehack.com | original ↗ | #bug-bounty | #arbitrary-file-read | #web-security

22.

Auditing Moodle's core hunting for logical bugs

research | 2025-04-21 22:00 | blog.quarkslab.com | original ↗ | #php | #vulnerability | #pentest

23.

SSRF & URI Validation Bypass in 2FAuth

vulnerability | 2024-11-22 13:00 | CVE-2024-52598 | xbow.com | original ↗ | #cloud | #vulnerability-research | #open-source

24.

New crazy payloads in the URL Validation Bypass Cheat Sheet

research | 2024-11-22 09:06 | portswigger.net | original ↗ | #burp-suite | #ssrf | #cheat-sheet

25.

Auditing Gradio 5, Hugging Face’s ML GUI framework

blog | 2024-10-10 16:00 | blog.trailofbits.com | original ↗ | #security-audit | #xss | #ssrf

26.

Introducing the URL validation bypass cheat sheet

research | 2024-09-05 12:36 | portswigger.net | original ↗ | #burp-suite | #ssrf | #open-redirect

27.

Portable Data exFiltration: XSS for PDFs

research | 2024-05-28 13:42 | portswigger.net | original ↗ | #xss | #ssrf | #pdf

28.

Webhook security checklist: How to build secure webhooks

blog | 2024-04-04 00:00 | aikido.dev | original ↗ | #api-security | #ssrf | #input-validation

29.

Exploiting GLPI during a Red Team engagement

vulnerability | 2024-03-20 23:00 | blog.quarkslab.com | original ↗ | #php | #sql-injection | #red-team

30.

‘Adapt payloads to your targets’: Brumens’ Bug Bounty tips for newbies

blog | 2024-03-07 09:07 | yeswehack.com | original ↗ | #bug-bounty | #rce | #interview