ssrf news
3 stories
Obfuscating IP Addresses as Hostnames, (Tue, Aug 25th)
A recent report highlights a technique where IP addresses can be obfuscated as hostnames, a method that can be exploited in various security attacks. This approach leverages the way systems resolve or interpret network requests, potentially bypassing security controls designed to detect and block direct IP address references. The core of the issue lies in the ability to represent an IP address…
U.S. CISA adds an MLflow flaw to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical server-side request forgery (SSRF) vulnerability in MLflow, tracked as CVE-2026-64849, to its Known Exploited Vulnerabilities (KEV) catalog. This designation indicates that the flaw is actively being exploited in the wild.
In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw
A critical vulnerability in Cisco Unified Communications Manager (CUCM) and CUCM Small and Medium Edition (SME) has been actively exploited by attackers less than a day after its public disclosure. The flaw allows for server-side request forgery (SSRF) and enables attackers to escalate their privileges to root access on affected systems.