CVE-2025-13872
Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allow
CVSS
9.1
Critical
EPSS
0.3%
p23
KEV
—
Exploit Today
7
0-100
Published: Dec 2, 2025 · Last modified: Sep 3, 2026 · CWE-918
0.3%EPSS · 30 days0.3%
2026-08-132026-09-09
Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to perform HTTP GET requests via crafted import requests to an arbitrary destination.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-820978.8 HIG—
———IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery (SSRF) vulnerability.9hCVE-2026-812657.5 HIG—
———IBM Langflow OSS 1.0.0 through 1.11.5.9hCVE-2026-812138.6 HIG—
———IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.9hCVE-2026-812078.5 HIG—
———IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project membership or role — fully controls scheme/host/port/path of an outbound fetch originating from a shared-infrastructure pod, and the WSDL body is reflected verbatim to the caller. The ds-canvas pod sits on the OpenShift overlay with reach to co-tenant services, in-cluster CP4D APIs, and link-local addresses. Scope is Changed, confidentiality High (response-reflecting), integrity Low (GET-only side-effects).9hCVE-2026-797235.0 MED—
———IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.9hCVE-2026-540546.5 MED—
———Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, `POST /api/files/url`, is vulnerable to Server-Side Request Forgery (SSRF). The HTTP downloader used by this endpoint fetches user-supplied URLs with redirects enabled and does not validate whether the target resolves to a public, external address. As a result, an authenticated user (or guest user if they are enabled) may be able to cause the Transmute server to make HTTP requests to internal or cloud-local resources from the server's network position. Because downloaded content is stored and can later be retrieved through `GET /api/files/{id}`, this issue can result in full-read SSRF rather than blind SSRF. This is fixed in version 1.3.0.9h