#ssrf
-
Oracle PeopleSoft zero-day exploited by ShinyHunters turns out to be three chained flaws
Zero Day Initiative researchers found that the critical CVE-2026-35273 in Oracle PeopleSoft is really three linked bugs across two components. At its core is the product's default trust in its own loopback address.
-
SAP Patches Maximum-Severity OAuth2 SSRF Flaw in Python Cloud SDK
SAP's October security release fixes 20 vulnerabilities, including a maximum-severity bug in its Python SDK that lets attackers steal application credentials.
-
Critical SonicWall SMA 1000 Flaw Exploited Days After Patch
CVE-2026-102255, rated a maximum CVSS 10.0, allows pre-authenticated SSRF attacks. Researchers have already logged 135 exploitation attempts.
-
SonicWall patches max-severity SSRF flaw in SMA1000 gateways
The company has issued emergency hotfixes for its SMA1000 series: the flaw let an unauthenticated attacker make the appliance issue requests on their behalf and reach internal functionality.
-
Attacks on MLflow: SSRF Vulnerability Exploited to Steal Cloud Secrets
Attackers have begun mass-scanning exposed MLflow servers, exploiting a critical SSRF vulnerability to reach cloud metadata. At the same time, the industrial platform FUXA has come under fire.