https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-47358.htmlhttps://patchthecve.com/cve/CVE-2026-47358.htmlFri, 24 Jul 2026 12:10:00 +0000HIGH 7.5: Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via external URL resolution in uploaded IaC templates when running in server mode. When Terrascan parses uploaded ARM templates or CloudFormation templates, it resolves external URLs referenced within those templates vihttps://patchthecve.com/cve/CVE-2026-47357.htmlhttps://patchthecve.com/cve/CVE-2026-47357.htmlFri, 24 Jul 2026 12:10:00 +0000HIGH 7.5: Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/remote/dir/scan) when running in server mode. An unauthenticated remote attacker can supply an attacker-controlled https://patchthecve.com/cve/CVE-2026-47356.htmlhttps://patchthecve.com/cve/CVE-2026-47356.htmlFri, 24 Jul 2026 12:10:00 +0000HIGH 7.5: Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) when running in server mode. An unauthenticated remote attacker can supply an arbitrary URL as the webhook_ur