API-Security 3 Blind SSRF via MCP OAuth Discovery — Redirect-Based Bypass of a Private-IP Guard Sep 1, 2026 SSRF with Response Disclosure on a Secrets-Retrieval Gateway Aug 9, 2026 Bypassing SMS & CAPTCHA Registration Controls Through a Native Magento REST API Aug 9, 2026