Curated security research, vulnerabilities, advisories and tools for practitioners.

#ssrf

Security coverage tagged ssrf.

1.

go2shell: Rooting Home Assistant through SSDP

research | 2026-10-07 22:05 | mccaulay.co.uk | Original ↗ | .md | #rce | #vulnerability-research | #privilege-escalation

2.

[Pt-Br] Por Trás do Espelho: Investigando Vulnerabilidades no MagicMirror² (CVE-2026-63642, CVE-2026-63643)

vulnerability | 2026-10-01 19:57 | CVE-2026-63642 | yokai.hakaisecurity.io | Original ↗ | .md | #vulnerability-research | #research | #ssrf

3.

How Model Evolution Has Reshaped Security AI Agents on H1 Platform

blog | 2026-10-01 18:12 | hackerone.com | Original ↗ | .md | #ai-security | #ssrf | #security

4.

A sandbox is only as closed as what an AI agent can reach

blog | 2026-08-12 00:00 | about.gitlab.com | Original ↗ | .md | #ai-security | #zero-day | #gitlab

5.

Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents

blog | 2026-06-25 00:00 | tenzai.com | Original ↗ | .md | #ai-security | #appsec | #benchmark

6.

How to Chain Vulnerabilities for RCE: From Image Metadata to Complete System Compromise

research | 2026-06-22 11:46 | hackenproof.com | Original ↗ | .md | #rce | #pentesting | #cve

7.

CVE-2026-45502 — Microsoft Exchange Server EWS InstallApp Server-Side Request Forgery

research | 2026-06-22 00:00 | CVE-2026-45502 | aretiq.ai | Original ↗ | .md | #cloud | #ssrf | #exchange-server

8.

The Red Agent POV: How it Reasoned its Way to SSRF

blog | 2026-06-17 14:33 | wiz.io | Original ↗ | .md | #cloud | #ai-pentesting | #ssrf

9.

Breaking Tenant Boundaries, When Path Traversal Isn't About the Filesystem

blog | 2026-05-26 12:45 | labs.cognisys.group | Original ↗ | .md | #data-exposure | #path-traversal | #saas

10.

Server-side request forgery: The ultimate Bug Bounty guide to exploiting SSRF vulnerabilities

blog | 2026-05-12 07:55 | yeswehack.com | Original ↗ | .md | #bug-bounty | #cloud | #rce

11.

Otto Support - SSRF and Token Passthrough with MCP

blog | 2026-05-07 00:00 | CVE-2026-27826 | bishopfox.com | Original ↗ | .md | #ai-security | #cloud | #rce

12.

Axios CVE-2026-40175: a critical bug that’s… not exploitable

vulnerability | Medium | 2026-04-14 00:00 | CVE-2026-40175 | aikido.dev | Original ↗ | .md | #prototype-pollution | #request-smuggling | #cve

13.

Apache Proxy Paradox CVE-2021-40438

vulnerability | 2026-03-06 09:10 | CVE-2021-40438 | labs.cognisys.group | Original ↗ | .md | #cloud | #pentesting | #apache

14.

How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code

vulnerability | 2026-03-03 17:05 | CVE-2026-25765 | projectdiscovery.io | Original ↗ | .md | #ai-security | #bug-bounty | #supply-chain

15.

XML external entity: The ultimate Bug Bounty guide to exploiting XXE vulnerabilities

blog | 2026-02-06 17:36 | yeswehack.com | Original ↗ | .md | #bug-bounty | #cloud | #rce

16.

Supabase Leaks, What We Found

blog | 2026-02-02 09:10 | labs.cognisys.group | Original ↗ | .md | #cloud-security | #pentesting | #account-takeover

17.

Blind trust: what is hidden behind the process of creating your PDF file?

research | 2025-12-29 11:57 | swarm.ptsecurity.com | Original ↗ | .md | #appsec | #vulnerability-research | #web-security

18.

Top 10 Web Application Security Vulnerabilities Every Team Should Know

blog | 2025-10-20 00:00 | aikido.dev | Original ↗ | .md | #web-security | #xss | #deserialization

19.

The minefield between syntaxes: exploiting syntax confusions in the wild

blog | 2025-10-17 11:30 | yeswehack.com | Original ↗ | .md | #bug-bounty | #arbitrary-file-read | #research

20.

CVE-2025-27888: Server-Side Request Forgery via URL Parsing Confusion in Apache Druid Proxy Endpoint

vulnerability | Medium | 2025-09-23 14:42 | CVE-2025-27888 | xbow.com | Original ↗ | .md | #zero-day | #vulnerability-research | #ssrf

21.

Cracking the lens: targeting HTTP's hidden attack-surface

research | 2025-09-03 07:38 | portswigger.net | Original ↗ | .md | #bug-bounty | #attack-surface | #portswigger

22.

The Quest for the Shortest Domain

blog | 2025-08-19 00:00 | josephthacker.com | Original ↗ | .md | #bug-bounty | #automation | #xss

23.

Another Byte Bites the Dust - How XBOW Turned a Blind SSRF into a File Reading Oracle

vulnerability | Critical | 2025-07-28 12:00 | xbow.com | Original ↗ | .md | #vulnerability-research | #ssrf | #exfiltration

24.

Chunked-body parsing flaws, making self-XSS great again, using HTTP redirect loops to achieve non-blind SSRFs – ethical hacker news roundup

blog | 2025-07-09 08:14 | yeswehack.com | Original ↗ | .md | #cloud | #web-security | #ssrf

25.

HowToHunt: Practical Methodologies and Test Cases for Web Vulnerability Hunting

blog | 2025-06-25 06:39 | github.com | Original ↗ | .md | #bug-bounty | #sql-injection | #xss

26.

Novel SSRF Technique Involving HTTP Redirect Loops

research | 2025-06-23 00:00 | slcyber.io | Original ↗ | .md | #vulnerability-research | #ssrf

27.

Beyond ‘../../’ - a practical guide to path traversal and arbitrary file read attacks

blog | 2025-05-15 12:51 | yeswehack.com | Original ↗ | .md | #bug-bounty | #arbitrary-file-read | #web-security

28.

Auditing Moodle's core hunting for logical bugs

research | 2025-04-21 22:00 | blog.quarkslab.com | Original ↗ | .md | #php | #vulnerability | #pentest

29.

Zilliz / Attu | 2.6.5

blog | 2025-04-11 00:00 | bishopfox.com | Original ↗ | .md | #kubernetes | #container-security | #vulnerability

30.

SSRF & URI Validation Bypass in 2FAuth

vulnerability | 2024-11-22 13:00 | CVE-2024-52598 | xbow.com | Original ↗ | .md | #cloud | #vulnerability-research | #open-source