Server-Side Request Forgery

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata ExfiltrationCVE-2026-33992pyload · CVSS 9.3 · 0.4% likely

   CWE-918

2. pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPsCVE-2026-48737pyload · CVSS 4.9 · 0.3% likely

   CWE-918

3. pyLoad has SSRF fix bypass via HTTP redirectCVE-2026-35459pyload · CVSS 9.1 · 0.3% likely

   CWE-918

4. pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameterCVE-2026-35187pyload · CVSS 7.7 · 0.3% likely

   CWE-918

5. pyLoad: SSRF via HTTP Redirect Bypass in parse_urls APICVE-2026-46561pyload · CVSS 5 · 0.2% likely

   CWE-918

6. pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification hostCVE-2026-123814pyload · CVSS 6.4 · 0.1% likely

   CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.