# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access](https://agentprime.io/advisories/CVE-2026-42398.md)
  `CVE-2026-42398` · CVE record: Elastic Kibana · CVSS 7.7 High · Not analysed yet · Published 28 May 2026 · Tags: Server-side request forgery (SSRF)
- [local-deep-research has an SSRF bypass in \`safe_get\`](https://agentprime.io/advisories/GHSA-g23j-2vwm-5c25.md)
  `GHSA-g23j-2vwm-5c25`, `CVE-2026-46526`, `PYSEC-2026-2611` · PyPI `local-deep-research`: affected `<1.6.10`, fixed in `1.6.10` · CVSS 5.0 Medium · Not analysed yet · Published 28 May 2026 · Tags: Server-side request forgery (SSRF)
- [Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin](https://agentprime.io/advisories/CVE-2026-49129.md)
  `CVE-2026-49129` · CVE record: MusicPlayerDaemon MPD · CVSS 6.9 Medium · Not analysed yet · Published 28 May 2026 · Tags: Server-side request forgery (SSRF)
- [compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem](https://agentprime.io/advisories/GHSA-w76h-q7c6-jpjp.md)
  `GHSA-w76h-q7c6-jpjp`, `CVE-2026-46380`, `PYSEC-2026-2427` · PyPI `compliance-trestle`: affected `<3.12.2 || >=4.0.0, <4.0.3`, fixed in `3.12.2`, `4.0.3` · CVSS 6.7 Medium · Not analysed yet · Published 28 May 2026 · Tags: Server-side request forgery (SSRF)
- [FlowIntel external reference URL probe allows server-side request forgery](https://agentprime.io/advisories/CVE-2026-9813.md)
  `CVE-2026-9813` · CVE record: flowintel flowintel · CVSS 6.2 Medium · Not analysed yet · Published 28 May 2026 · Tags: Server-side request forgery (SSRF)
- [Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route](https://agentprime.io/advisories/CVE-2026-5737.md)
  `CVE-2026-5737` · CVE record: bensibley Independent Analytics – WordPress Analytics Plugin · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2026 · Tags: Server-side request forgery (SSRF)
- [Jenkins Active Directory Plugin follows LDAP referrals by default](https://agentprime.io/advisories/GHSA-wrhr-54p6-q97f.md)
  `GHSA-wrhr-54p6-q97f`, `CVE-2026-48918` · Maven `org.jenkins-ci.plugins:active-directory`: affected `<2.41.1`, fixed in `2.41.1` · CVSS 6.6 Medium · Not analysed yet · Published 27 May 2026 · Tags: Server-side request forgery (SSRF)
- [Jenkins LDAP Plugin follows LDAP referrals](https://agentprime.io/advisories/GHSA-fmjp-mw89-c6h6.md)
  `GHSA-fmjp-mw89-c6h6`, `CVE-2026-48916` · Maven `org.jenkins-ci.plugins:ldap`: affected `<807.809.vd3a`, fixed in `807.809.vd3a` · CVSS 6.6 Medium · Not analysed yet · Published 27 May 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint](https://agentprime.io/advisories/CVE-2026-9312.md)
  `CVE-2026-9312` · CVE record: GitHub Enterprise Server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint](https://agentprime.io/advisories/CVE-2026-8606.md)
  `CVE-2026-8606` · CVE record: GitHub Enterprise Server · CVSS 7.0 High · Not analysed yet · Published 26 May 2026 · Tags: Server-side request forgery (SSRF)
- [MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch](https://agentprime.io/advisories/CVE-2026-42336.md)
  `CVE-2026-42336` · CVE record: 1Panel-dev MaxKB · CVSS 5.1 Medium · Not analysed yet · Published 26 May 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [MaxKB: Unauthenticated SSRF via Workflow Template Import](https://agentprime.io/advisories/CVE-2026-45412.md)
  `CVE-2026-45412` · CVE record: 1Panel-dev MaxKB · CVSS 6.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Server-side request forgery (SSRF)
- [MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy](https://agentprime.io/advisories/CVE-2026-42335.md)
  `CVE-2026-42335` · CVE record: 1Panel-dev MaxKB · CVSS 6.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Server-side request forgery (SSRF)
- [Weblate has a Server-Side Request Forgery issue](https://agentprime.io/advisories/GHSA-hfpv-mc5v-p9mm.md)
  `GHSA-hfpv-mc5v-p9mm`, `CVE-2025-66407`, `PYSEC-2025-231` · PyPI `weblate`: affected `<5.15`, fixed in `5.15` · CVSS 5.0 Medium · Not analysed yet · Published 26 May 2026 · Tags: Cross-site request forgery (CSRF), Server-side request forgery (SSRF)
- [Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.](https://agentprime.io/advisories/CVE-2026-2264.md)
  `CVE-2026-2264` · CVE record: Google Cloud Apigee-X · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Server-side request forgery (SSRF)
- [IBM webMethods Integration Sever is vulnerable to server-side request forgery](https://agentprime.io/advisories/CVE-2025-14290.md)
  `CVE-2025-14290` · CVE record: IBM webMethods Integration (on prem) -Integration Server · CVSS 5.4 Medium · Not analysed yet · Published 26 May 2026 · Tags: Server-side request forgery (SSRF)
- [e107: Server-Side Request Forgery (SSRF) in the remote file fetcher](https://agentprime.io/advisories/CVE-2026-43936.md)
  `CVE-2026-43936` · CVE record: e107inc e107 · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Server-side request forgery (SSRF)
- [Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator](https://agentprime.io/advisories/CVE-2026-40564.md)
  `CVE-2026-40564` · CVE record: Apache Software Foundation Apache Flink Kubernetes Operator · CVSS 6.5 Medium · Not analysed yet · Published 26 May 2026 · Tags: Information disclosure, Server-side request forgery (SSRF)
- [Karakeep has a SSRF Protection Bypass via Redirect Handling](https://agentprime.io/advisories/CVE-2026-45082.md)
  `CVE-2026-45082` · CVE record: karakeep-app karakeep · CVSS 7.6 High · Not analysed yet · Published 26 May 2026 · Tags: Server-side request forgery (SSRF)
- [Apache Shiro Vulnerable to Open Redirect, Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-wpqm-4gwx-w843.md)
  `GHSA-wpqm-4gwx-w843`, `CVE-2026-44598` · Maven `org.apache.shiro:shiro-jakarta-ee`: affected `>=2.0.0-alpha-0, <2.2.0 || >=3.0.0-alpha-1, <3.0.0-alpha-2`, fixed in `2.2.0`, `3.0.0-alpha-2` · CVSS 5.1 Medium · Not analysed yet · Published 26 May 2026 · Tags: Open redirect, Server-side request forgery (SSRF)
- [Server-side request forgery in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-48843.md)
  `CVE-2026-48843` · CVE record: Roundcube Webmail · CVSS 7.2 High · Not analysed yet · Published 25 May 2026 · Tags: Server-side request forgery (SSRF)
- [SSRF allowlist bypass via percent-encoded host in hackney](https://agentprime.io/advisories/GHSA-pj7v-xfvx-wmjq.md)
  `GHSA-pj7v-xfvx-wmjq`, `CVE-2026-47076`, `EEF-CVE-2026-47076` · Hex `hackney`: affected `>=0.13.0, <4.0.1`, fixed in `4.0.1` · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: Server-side request forgery (SSRF), CWE-436
- [YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery](https://agentprime.io/advisories/CVE-2026-9464.md)
  `CVE-2026-9464` · CVE record: YunaiV yudao-cloud · CVSS 5.1 Medium · Not analysed yet · Published 25 May 2026 · Tags: Server-side request forgery (SSRF)
- [ItzCrazyKns Vane Model Provider API route.ts server-side request forgery](https://agentprime.io/advisories/CVE-2026-9372.md)
  `CVE-2026-9372` · CVE record: ItzCrazyKns Vane · CVSS 6.9 Medium · Not analysed yet · Published 24 May 2026 · Tags: Server-side request forgery (SSRF)
- [calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery](https://agentprime.io/advisories/CVE-2026-9304.md)
  `CVE-2026-9304` · CVE record: calcom cal.diy · CVSS 2.3 Low · Not analysed yet · Published 23 May 2026 · Tags: Server-side request forgery (SSRF)
- [instagrapi: Unsafe signup challenge path handling in instagrapi](https://agentprime.io/advisories/GHSA-ggxf-37hm-9wqf.md)
  `GHSA-ggxf-37hm-9wqf` · PyPI `instagrapi`: affected `<2.6.9`, fixed in `2.6.9` · CVSS 6.5 Medium · Not analysed yet · Published 23 May 2026 · Tags: Server-side request forgery (SSRF)
- [aiograpi: Unsafe signup challenge path handling](https://agentprime.io/advisories/GHSA-jh37-x3fv-4x72.md)
  `GHSA-jh37-x3fv-4x72`, `CVE-2026-47157`, `PYSEC-2026-2337` · PyPI `aiograpi`: affected `<0.9.10`, fixed in `0.9.10` · CVSS 6.5 Medium · Not analysed yet · Published 23 May 2026 · Tags: Server-side request forgery (SSRF)
- [Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification](https://agentprime.io/advisories/GHSA-w4g9-mxgg-j532.md)
  `GHSA-w4g9-mxgg-j532`, `CVE-2026-46717`, `GO-2026-5687` · Go `github.com/nezhahq/nezha`: affected `>=1.4.0, <1.14.15-0.20260517022419-d06d539d34c1`, fixed in `1.14.15-0.20260517022419-d06d539d34c1` · CVSS 7.7 High · Not analysed yet · Published 23 May 2026 · Tags: Broken access control, Server-side request forgery (SSRF)
- [TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks](https://agentprime.io/advisories/CVE-2026-39965.md)
  `CVE-2026-39965` · CVE record: baptisteArno typebot.io · CVSS 7.7 High · Not analysed yet · Published 22 May 2026 · Tags: Server-side request forgery (SSRF)
- [TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation](https://agentprime.io/advisories/CVE-2026-34207.md)
  `CVE-2026-34207` · CVE record: baptisteArno typebot.io · CVSS 7.6 High · Not analysed yet · Published 22 May 2026 · Tags: Server-side request forgery (SSRF), CWE-20
- [TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls](https://agentprime.io/advisories/CVE-2026-33712.md)
  `CVE-2026-33712` · CVE record: baptisteArno typebot.io · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 May 2026 · Tags: Broken access control, Server-side request forgery (SSRF)
- [Server-side request forgery in Devolutions Server](https://agentprime.io/advisories/CVE-2026-7325.md)
  `CVE-2026-7325` · CVE record: Devolutions Server · CVSS 7.1 High · Not analysed yet · Published 22 May 2026 · Tags: Server-side request forgery (SSRF)
- [FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter](https://agentprime.io/advisories/CVE-2026-7798.md)
  `CVE-2026-7798` · CVE record: techjewel FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution · CVSS 5.4 Medium · Not analysed yet · Published 22 May 2026 · Tags: Server-side request forgery (SSRF)
- [Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation](https://agentprime.io/advisories/GHSA-gjwq-9v8p-47w7.md)
  `GHSA-gjwq-9v8p-47w7`, `CVE-2026-7890`, `PKSA-9c7x-8d4g-nf5y` · Packagist `concrete5/concrete5`: affected `<9.5.1`, fixed in `9.5.1` · CVSS 2.1 Low · Not analysed yet · Published 22 May 2026 · Tags: Server-side request forgery (SSRF)
- [Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)](https://agentprime.io/advisories/GHSA-cqp8-fcvh-x7r3.md)
  `GHSA-cqp8-fcvh-x7r3`, `CVE-2026-46678`, `PYSEC-2026-2978`, `PYSEC-2026-2982` · PyPI `pydantic-ai` and 1 more: affected `>=1.56.0, <1.99.0`, fixed in `1.99.0` · CVSS 6.8 Medium · Not analysed yet · Published 21 May 2026 · Tags: Server-side request forgery (SSRF)
- [FlaskBB: SSRF in get_image_info() via unrestricted avatar URL](https://agentprime.io/advisories/GHSA-xq32-9g7q-7297.md)
  `GHSA-xq32-9g7q-7297`, `CVE-2026-46556`, `PYSEC-2026-2479` · PyPI `flaskbb`: affected `<=2.2.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 21 May 2026 · Tags: Server-side request forgery (SSRF)
- [NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)](https://agentprime.io/advisories/GHSA-2c5x-4jgf-88mj.md)
  `GHSA-2c5x-4jgf-88mj`, `CVE-2026-46548` · npm `nocodb`: affected `<=0.301.3`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 21 May 2026 · Tags: Server-side request forgery (SSRF)
- [Snappy : SSRF and local file read via the xsl-style-sheet option](https://agentprime.io/advisories/GHSA-c5fp-p67m-gq56.md)
  `GHSA-c5fp-p67m-gq56`, `CVE-2026-46683`, `PKSA-p1pz-jv1j-6msg` · Packagist `knplabs/knp-snappy`: affected `<1.7.0`, fixed in `1.7.0` · CVSS 6.9 Medium · Not analysed yet · Published 21 May 2026 · Tags: Server-side request forgery (SSRF)
- [pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API](https://agentprime.io/advisories/GHSA-8rp3-xc6w-5qp5.md)
  `GHSA-8rp3-xc6w-5qp5`, `CVE-2026-46561`, `PYSEC-2026-2991` · PyPI `pyload-ng`: affected `<0.5.0b3.dev100`, fixed in `0.5.0b3.dev100` · CVSS 5.0 Medium · Not analysed yet · Published 21 May 2026 · Tags: Server-side request forgery (SSRF)
- [Crawlee for Python: SSRF via sitemap-derived URLs](https://agentprime.io/advisories/GHSA-3r75-xc34-5f44.md)
  `GHSA-3r75-xc34-5f44`, `CVE-2026-46497`, `PYSEC-2026-2430` · PyPI `crawlee`: affected `>=1.0.0, <1.7.0`, fixed in `1.7.0` · CVSS 2.3 Low · Not analysed yet · Published 21 May 2026 · Tags: Server-side request forgery (SSRF)
- [Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter](https://agentprime.io/advisories/CVE-2026-6394.md)
  `CVE-2026-6394` · CVE record: wpdive Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE · CVSS 5.4 Medium · Not analysed yet · Published 20 May 2026 · Tags: Server-side request forgery (SSRF)
- [@angular/platform-server: SSRF via Hostname Hijacking](https://agentprime.io/advisories/GHSA-rfh7-fxqc-q52v.md)
  `GHSA-rfh7-fxqc-q52v`, `CVE-2026-46417` · npm `@angular/platform-server`: affected `<=18.2.14 || >=19.0.0-next.0, <19.2.22 || >=20.0.0-next.0, <20.3.21 || >=21.0.0-next.0, <21.2.13 || >=22.0.0-next.0, <22.0.0-next.12`, fixed in `19.2.22`, `20.3.21`, `21.2.13`, `22.0.0-next.12` · CVSS 8.8 High · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl](https://agentprime.io/advisories/GHSA-qg89-qwwh-5f3j.md)
  `GHSA-qg89-qwwh-5f3j`, `CVE-2026-46372` · npm `sillytavern`: affected `<1.18.0`, fixed in `1.18.0` · CVSS 8.5 High · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint](https://agentprime.io/advisories/GHSA-686c-7vgv-v3fx.md)
  `GHSA-686c-7vgv-v3fx`, `CVE-2026-45796`, `GO-2026-5169` · Go `github.com/coder/coder` and 1 more: affected `<=0.27.3`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass](https://agentprime.io/advisories/GHSA-3875-8gcx-7v46.md)
  `GHSA-3875-8gcx-7v46`, `CVE-2026-56348` · npm `n8n`: affected `<2.20.0`, fixed in `2.20.0` · CVSS 5.3 Medium · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in tenable Terrascan](https://agentprime.io/advisories/CVE-2026-47358.md)
  `CVE-2026-47358` · CVE record: tenable Terrascan · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Path traversal, Server-side request forgery (SSRF), CWE-610
- [Server-side request forgery in tenable Terrascan](https://agentprime.io/advisories/CVE-2026-47357.md)
  `CVE-2026-47357` · CVE record: tenable Terrascan · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Path traversal, Server-side request forgery (SSRF), CWE-610
- [Server-side request forgery in tenable Terrascan](https://agentprime.io/advisories/CVE-2026-47356.md)
  `CVE-2026-47356` · CVE record: tenable Terrascan · CVSS 8.7 High · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer](https://agentprime.io/advisories/GHSA-j3fj-qppj-fmmc.md)
  `GHSA-j3fj-qppj-fmmc`, `CVE-2026-45709`, `GO-2026-5446` · Go `github.com/axllent/mailpit`: affected `>=1.28.3, <1.30.0`, fixed in `1.30.0` · CVSS 5.8 Medium · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs](https://agentprime.io/advisories/GHSA-hv85-774v-26fg.md)
  `GHSA-hv85-774v-26fg` · npm `auth-fetch-mcp`: affected `<3.0.1`, fixed in `3.0.1` · CVSS 8.2 High · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis](https://agentprime.io/advisories/GHSA-4fg7-f244-3j49.md)
  `GHSA-4fg7-f244-3j49`, `CVE-2026-46391` · npm `@haxtheweb/open-apis`: affected `<26.0.0`, fixed in `26.0.0` · CVSS 8.7 High · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF), CWE-183
- [HAXcms createSite SSRF Enables Arbitrary File Read](https://agentprime.io/advisories/GHSA-q862-gcgq-5m6g.md)
  `GHSA-q862-gcgq-5m6g`, `CVE-2026-46393` · npm `@haxtheweb/haxcms-nodejs`: affected `<26.0.0`, fixed in `26.0.0` · CVSS 7.1 High · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access](https://agentprime.io/advisories/CVE-2026-31910.md)
  `CVE-2026-31910` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [Apache OFBiz: Low-Privilege SSRF in Content Component](https://agentprime.io/advisories/CVE-2026-29226.md)
  `CVE-2026-29226` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.3 High · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server](https://agentprime.io/advisories/CVE-2026-33234.md)
  `CVE-2026-33234` · CVE record: Significant-Gravitas AutoGPT · CVSS 5.0 Medium · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar_url query parameter of the Scalar Proxy endpoint.](https://agentprime.io/advisories/CVE-2026-30118.md)
  `CVE-2026-30118` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Server-side request forgery (SSRF)
- [Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links](https://agentprime.io/advisories/GHSA-2r69-qgv3-hr65.md)
  `GHSA-2r69-qgv3-hr65`, `CVE-2026-45245` · npm `@steipete/summarize`: affected `<0.15.1`, fixed in `0.15.1` · CVSS 4.6 Medium · Not analysed yet · Published 18 May 2026 · Tags: Server-side request forgery (SSRF), CWE-940
- [Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)](https://agentprime.io/advisories/GHSA-3v9w-6365-9w54.md)
  `GHSA-3v9w-6365-9w54`, `CVE-2026-45298`, `GO-2026-5101` · Go `github.com/amir20/dozzle`: affected `<=8.14.12`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 18 May 2026 · Tags: Server-side request forgery (SSRF)
- [Statamic CMS: Server-Side Request Forgery via Glide](https://agentprime.io/advisories/GHSA-pf9c-ch8r-2958.md)
  `GHSA-pf9c-ch8r-2958`, `CVE-2026-45660`, `PKSA-7fht-jznj-7mgv` · Packagist `statamic/cms`: affected `<5.73.22 || >=6.0.0-alpha.1, <6.18.1`, fixed in `5.73.22`, `6.18.1` · CVSS 5.4 Medium · Not analysed yet · Published 18 May 2026 · Tags: Server-side request forgery (SSRF)
- [Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping](https://agentprime.io/advisories/GHSA-5rv5-xj5j-3484.md)
  `GHSA-5rv5-xj5j-3484`, `CVE-2026-33637` · RubyGems `faraday`: affected `>=2.0.0, <2.14.2`, fixed in `2.14.2` · CVSS 0.0 None · Not analysed yet · Published 18 May 2026 · Tags: Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI2LTA1LTE4VDE0OjUxOjUxLjAwMDAwMFoiLCJHSFNBLTVydjUteGo1ai0zNDg0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI2LTA1LTI4VDE5OjUxOjMyLjIxOTAwMFoiLCJDVkUtMjAyNi00OTA5MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI2LTA1LTI4VDE5OjUxOjMyLjIxOTAwMFoiLCJDVkUtMjAyNi00OTA5MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.