dfpc-coe CloudTAK

• CVE-2026-55177 High 7.6 CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard 0.4%
• CVE-2026-54546 Medium 5.0 CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard 0.4%