# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled](https://agentprime.io/advisories/GHSA-q4q6-r8wh-5cgh.md)
  `GHSA-q4q6-r8wh-5cgh`, `CVE-2026-34084`, `PKSA-8cfg-tzhf-fr83` · Packagist `phpoffice/phpspreadsheet`: affected `<1.30.3 || >=2.0.0, <2.1.15 || >=2.2.0, <2.4.4 || >=3.3.0, <3.10.4 || >=4.0.0, <5.6.0`, fixed in `1.30.3`, `2.1.15`, `2.4.4`, `3.10.4`, `5.6.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Apr 2026 · Tags: Insecure deserialization, Server-side request forgery (SSRF)
- [WordPress Share This Image plugin <= 2.14 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-42641.md)
  `CVE-2026-42641` · CVE record: ILLID Share This Image · CVSS 5.4 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Dell Disk Library for mainframe DLm8700 and others](https://agentprime.io/advisories/CVE-2026-23773.md)
  `CVE-2026-23773` · CVE record: Dell Disk Library for mainframe DLm8700 and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery](https://agentprime.io/advisories/CVE-2026-7305.md)
  `CVE-2026-7305` · CVE record: Xuxueli xxl-job · CVSS 5.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in NVIDIA NemoClaw](https://agentprime.io/advisories/CVE-2026-24231.md)
  `CVE-2026-24231` · CVE record: NVIDIA NemoClaw · CVSS 6.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [o2oa URL Fetching FileAction.java FileAction server-side request forgery](https://agentprime.io/advisories/CVE-2026-7291.md)
  `CVE-2026-7291` · CVE record: o2oa · CVSS 5.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue](https://agentprime.io/advisories/GHSA-r2jq-4h3x-rfj6.md)
  `GHSA-r2jq-4h3x-rfj6`, `CVE-2026-7223` · npm `@dadigua/hyperchat`: affected `<=2.0.0-alpha.63`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery](https://agentprime.io/advisories/CVE-2026-7221.md)
  `CVE-2026-7221` · CVE record: TencentCloudBase CloudBase-MCP · CVSS 6.9 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery](https://agentprime.io/advisories/CVE-2026-7178.md)
  `CVE-2026-7178` · CVE record: ChatGPTNextWeb NextChat · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery](https://agentprime.io/advisories/CVE-2026-7177.md)
  `CVE-2026-7177` · CVE record: ChatGPTNextWeb NextChat · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [mcp-url-downloader has a Server-Side Request Forgery issue](https://agentprime.io/advisories/GHSA-h7xc-4mv8-59fj.md)
  `GHSA-h7xc-4mv8-59fj`, `CVE-2026-7158`, `PYSEC-2026-2631` · PyPI `mcp-url-downloader`: affected `<=0.1.0`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [auto-favicon has a Server-Side Request Forgery issue](https://agentprime.io/advisories/GHSA-vmh7-9c7h-2pgg.md)
  `GHSA-vmh7-9c7h-2pgg`, `CVE-2026-7150`, `PYSEC-2026-2386` · PyPI `auto-favicon`: affected `<=1.0.1`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery](https://agentprime.io/advisories/CVE-2026-7147.md)
  `CVE-2026-7147` · CVE record: JoeCastrom mcp-chat-studio · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery](https://agentprime.io/advisories/CVE-2026-7146.md)
  `CVE-2026-7146` · CVE record: AlejandroArciniegas mcp-data-vis · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [ShadowCloneLabs GlutamateMCPServers puppeteer_navigate index.ts server-side request forgery](https://agentprime.io/advisories/CVE-2026-7094.md)
  `CVE-2026-7094` · CVE record: ShadowCloneLabs GlutamateMCPServers · CVSS 6.9 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [HBAI-Ltd Toonflow-app getCodeByLink Endpoint getCodeByLink.ts fetch server-side request forgery](https://agentprime.io/advisories/CVE-2026-7084.md)
  `CVE-2026-7084` · CVE record: HBAI-Ltd Toonflow-app · CVSS 5.3 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [BidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgery](https://agentprime.io/advisories/CVE-2026-7065.md)
  `CVE-2026-7065` · CVE record: BidingCC BuildingAI · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery](https://agentprime.io/advisories/CVE-2026-7025.md)
  `CVE-2026-7025` · CVE record: Typecho · CVSS 6.9 Medium · Not analysed yet · Published 26 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks](https://agentprime.io/advisories/GHSA-j4c5-89f5-f3pm.md)
  `GHSA-j4c5-89f5-f3pm`, `CVE-2026-45000` · npm `openclaw`: affected `<2026.4.20`, fixed in `2026.4.20` · CVSS 2.3 Low · Not analysed yet · Published 25 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw: QQBot direct media upload skipped URL SSRF validation](https://agentprime.io/advisories/GHSA-c4qg-j8jg-42q5.md)
  `GHSA-c4qg-j8jg-42q5`, `CVE-2026-44117` · npm `openclaw`: affected `<2026.4.20`, fixed in `2026.4.20` · CVSS 6.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [pagekit download server-side request forgery](https://agentprime.io/advisories/CVE-2026-6983.md)
  `CVE-2026-6983` · CVE record: pagekit · CVSS 5.1 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [IhateCreatingUserNames2 AiraHub2 Endpoint AiraHub.py sync_agents server-side request forgery](https://agentprime.io/advisories/CVE-2026-6981.md)
  `CVE-2026-6981` · CVE record: IhateCreatingUserNames2 AiraHub2 · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [devlikeapro WAHA API Request media.controller.ts server-side request forgery](https://agentprime.io/advisories/CVE-2026-6979.md)
  `CVE-2026-6979` · CVE record: devlikeapro WAHA · CVSS 5.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Lemmy has SSRF in /api/v3/post via Webmention dispatch](https://agentprime.io/advisories/GHSA-3jvj-v6w2-h948.md)
  `GHSA-3jvj-v6w2-h948`, `CVE-2026-42180` · crates.io `lemmy_api_common`: affected `<0.19.18`, fixed in `0.19.18` · CVSS 6.3 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image](https://agentprime.io/advisories/GHSA-h6hf-9846-xwrq.md)
  `GHSA-h6hf-9846-xwrq`, `CVE-2026-42181` · crates.io `lemmy_api_common`: affected `<0.19.18`, fixed in `0.19.18` · CVSS 6.5 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality](https://agentprime.io/advisories/CVE-2026-31955.md)
  `CVE-2026-31955` · CVE record: xibosignage xibo-cms · CVSS 4.9 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)](https://agentprime.io/advisories/GHSA-88gm-j2wx-58h6.md)
  `GHSA-88gm-j2wx-58h6`, `CVE-2026-41321` · npm `@astrojs/cloudflare`: affected `<13.1.10`, fixed in `13.1.10` · CVSS 2.2 Low · Not analysed yet · Published 23 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Entra ID Entitlement Management Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-35431.md)
  `CVE-2026-35431` · CVE record: Microsoft Microsoft Entra · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Purview eDiscovery Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-26150.md)
  `CVE-2026-26150` · CVE record: Microsoft Microsoft Purview eDiscovery · CVSS 8.6 High · Not analysed yet · Published 23 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Dynamics 365 (online) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-32210.md)
  `CVE-2026-32210` · CVE record: Microsoft Microsoft Dynamics 365 (online) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [SocialEngine <= 7.8.0 Blind SSRF via /core/link/preview](https://agentprime.io/advisories/CVE-2026-41461.md)
  `CVE-2026-41461` · CVE record: SocialEngine SocialEngine · CVSS 6.3 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction](https://agentprime.io/advisories/CVE-2026-41177.md)
  `CVE-2026-41177` · CVE record: Squidex squidex · CVSS 5.5 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Path traversal, Server-side request forgery (SSRF)
- [Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)](https://agentprime.io/advisories/CVE-2026-41172.md)
  `CVE-2026-41172` · CVE record: Squidex squidex · CVSS 7.3 High · Not analysed yet · Published 22 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient](https://agentprime.io/advisories/CVE-2026-41171.md)
  `CVE-2026-41171` · CVE record: Squidex squidex · CVSS 7.3 High · Not analysed yet · Published 22 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests](https://agentprime.io/advisories/CVE-2026-41170.md)
  `CVE-2026-41170` · CVE record: Squidex squidex · CVSS 7.2 High · Not analysed yet · Published 22 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [WeKan < 8.35 SSRF via Webhook URL](https://agentprime.io/advisories/CVE-2026-41455.md)
  `CVE-2026-41455` · CVE record: wekan wekan · CVSS 6.3 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)](https://agentprime.io/advisories/GHSA-xjvc-pw2r-6878.md)
  `GHSA-xjvc-pw2r-6878`, `CVE-2026-41887`, `PKSA-4s1v-jz1f-4jpx` · Packagist `flarum/core`: affected `<1.8.16 || >=2.0.0-beta.1, <2.0.0-rc.1`, fixed in `1.8.16`, `2.0.0-rc.1` · CVSS 4.9 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Path traversal, Server-side request forgery (SSRF)
- [monetr: Server-side request forgery in Lunch Flow link creation and refresh](https://agentprime.io/advisories/GHSA-29v9-frvh-c426.md)
  `GHSA-29v9-frvh-c426`, `CVE-2026-41644`, `GO-2026-4966` · Go `github.com/monetr/monetr`: affected `<1.12.5`, fixed in `1.12.5` · CVSS 8.3 High · Not analysed yet · Published 22 Apr 2026 · Tags: Information disclosure, Denial of service, Server-side request forgery (SSRF)
- [An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0).](https://agentprime.io/advisories/CVE-2026-35548.md)
  `CVE-2026-35548` · CVE record · CVSS 8.5 High · Not analysed yet · Published 22 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack](https://agentprime.io/advisories/CVE-2026-5921.md)
  `CVE-2026-5921` · CVE record: GitHub Enterprise Server · CVSS 8.9 High · Not analysed yet · Published 21 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Bagisto affected by Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-x3f9-vcp2-hgcw.md)
  `GHSA-x3f9-vcp2-hgcw`, `CVE-2026-6744`, `PKSA-5txd-q8wz-njb7` · Packagist `bagisto/bagisto`: affected `<=2.3.15`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints](https://agentprime.io/advisories/CVE-2026-40566.md)
  `CVE-2026-40566` · CVE record: freescout-help-desk freescout · CVSS 4.1 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Glances has SSRF in IP Plugin via public_api leading to credential leakage](https://agentprime.io/advisories/GHSA-g5pq-48mj-jvw8.md)
  `GHSA-g5pq-48mj-jvw8`, `CVE-2026-35587`, `PYSEC-2026-2176` · PyPI `glances`: affected `<4.5.4`, fixed in `4.5.4` · CVSS 7.3 High · Not analysed yet · Published 21 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading](https://agentprime.io/advisories/GHSA-6w67-hwm5-92mq.md)
  `GHSA-6w67-hwm5-92mq`, `CVE-2026-33626`, `PYSEC-2026-2607` · PyPI `lmdeploy`: affected `<=0.12.2`, no fixed version yet · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.45 · Not analysed yet · Published 21 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Vexa Webhook Feature has a SSRF Vulnerability](https://agentprime.io/advisories/CVE-2026-25883.md)
  `CVE-2026-25883` · CVE record: Vexa-ai vexa · CVSS 5.8 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Vvveb < 1.0.8.1 SSRF via oEmbedProxy](https://agentprime.io/advisories/CVE-2026-34428.md)
  `CVE-2026-34428` · CVE record: givanz Vvveb · CVSS 8.3 High · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Qibo CMS headers server-side request forgery](https://agentprime.io/advisories/CVE-2026-6649.md)
  `CVE-2026-6649` · CVE record: Qibo CMS · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery](https://agentprime.io/advisories/CVE-2026-6625.md)
  `CVE-2026-6625` · CVE record: moxi624 Mogu Blog v2 · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery](https://agentprime.io/advisories/CVE-2026-6618.md)
  `CVE-2026-6618` · CVE record: langgenius dify · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery](https://agentprime.io/advisories/CVE-2026-6617.md)
  `CVE-2026-6617` · CVE record: langgenius dify · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery](https://agentprime.io/advisories/CVE-2026-6616.md)
  `CVE-2026-6616` · CVE record: TransformerOptimus SuperAGI · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [AgentScope vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-crx8-wpv6-jrj2.md)
  `GHSA-crx8-wpv6-jrj2`, `CVE-2026-6606`, `PYSEC-2026-2332` · PyPI `agentscope`: affected `<=1.0.18`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [AgentScope vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-8ggf-r3vm-p3jc.md)
  `GHSA-8ggf-r3vm-p3jc`, `CVE-2026-6605`, `PYSEC-2026-2330` · PyPI `agentscope`: affected `<=1.0.18`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [AgentScope vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-659x-hm75-hpv7.md)
  `GHSA-659x-hm75-hpv7`, `CVE-2026-6604`, `PYSEC-2026-2329` · PyPI `agentscope`: affected `<=1.0.18`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [RAGAS has SSRF via Multi-Modal Faithfulness Collections Module](https://agentprime.io/advisories/GHSA-95ww-475f-pr4f.md)
  `GHSA-95ww-475f-pr4f`, `CVE-2026-6587`, `PYSEC-2026-3046` · PyPI `ragas`: affected `>=0.2.3, <=0.4.3`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [PHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery](https://agentprime.io/advisories/CVE-2026-6573.md)
  `CVE-2026-6573` · CVE record: PHPEMS · CVSS 5.3 Medium · Not analysed yet · Published 19 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing](https://agentprime.io/advisories/CVE-2026-40348.md)
  `CVE-2026-40348` · CVE record: leepeuker movary · CVSS 7.7 High · Not analysed yet · Published 18 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets](https://agentprime.io/advisories/GHSA-f7fh-qg34-x2xh.md)
  `GHSA-f7fh-qg34-x2xh`, `CVE-2026-43576` · npm `openclaw`: affected `<2026.4.5`, fixed in `2026.4.5` · CVSS 4.9 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Open redirect, Server-side request forgery (SSRF)
- [OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage](https://agentprime.io/advisories/GHSA-536q-mj95-h29h.md)
  `GHSA-536q-mj95-h29h`, `CVE-2026-43580` · npm `openclaw`: affected `<2026.4.10`, fixed in `2026.4.10` · CVSS 4.9 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Broken access control, Server-side request forgery (SSRF)
- [OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement](https://agentprime.io/advisories/GHSA-527m-976r-jf79.md)
  `GHSA-527m-976r-jf79`, `CVE-2026-43573` · npm `openclaw`: affected `<2026.4.10`, fixed in `2026.4.10` · CVSS 4.9 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Broken access control, Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI2LTA0LTE3VDIyOjExOjMzLjAwMDAwMFoiLCJHSFNBLTUyN20tOTc2ci1qZjc5Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI2LTA0LTI5VDIwOjU0OjU0LjAwMDAwMFoiLCJHSFNBLXdyMzItOTloaC02ZjM1Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI2LTA0LTI5VDIwOjU0OjU0LjAwMDAwMFoiLCJHSFNBLXdyMzItOTloaC02ZjM1Il0>. Everything for agents: <https://agentprime.io/llms.txt>.