# Server-side request forgery (SSRF). The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning](https://agentprime.io/advisories/CVE-2026-47664.md) `CVE-2026-47664` · CVE record: aehrc pathling · CVSS 8.6 High · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-20, CWE-345 - [Pathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLs](https://agentprime.io/advisories/CVE-2026-47662.md) `CVE-2026-47662` · CVE record: aehrc pathling · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Hard-coded credentials, Server-side request forgery (SSRF), CWE-20 - [Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration](https://agentprime.io/advisories/CVE-2026-47660.md) `CVE-2026-47660` · CVE record: aehrc pathling · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Hard-coded credentials, Server-side request forgery (SSRF) - [Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}](https://agentprime.io/advisories/CVE-2026-47659.md) `CVE-2026-47659` · CVE record: aehrc pathling · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Path traversal, Server-side request forgery (SSRF) - [Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification](https://agentprime.io/advisories/CVE-2026-17597.md) `CVE-2026-17597` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.1 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Improper URL Scheme and Destination Validation in SmartCenter browserseturl Command](https://agentprime.io/advisories/CVE-2026-15570.md) `CVE-2026-15570` · CVE record: Vestel Telefunken TE24553B45V2DZ Smart TV · CVSS 7.1 High · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF) - [OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects](https://agentprime.io/advisories/CVE-2026-16637.md) `CVE-2026-16637` · CVE record: OPeNDAP Inc. hyrax-docker · CVSS 6.5 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Information disclosure, Server-side request forgery (SSRF) - [TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality](https://agentprime.io/advisories/CVE-2026-54205.md) `CVE-2026-54205` · CVE record: Tobit Laboratories AG TeamDavid · CVSS 6.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-20 - [TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality](https://agentprime.io/advisories/CVE-2026-54207.md) `CVE-2026-54207` · CVE record: Tobit Laboratories AG TeamDavid · CVSS 6.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-20 - [TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality](https://agentprime.io/advisories/CVE-2026-54206.md) `CVE-2026-54206` · CVE record: Tobit Laboratories AG TeamDavid · CVSS 6.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-20 - [TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionality](https://agentprime.io/advisories/CVE-2026-54204.md) `CVE-2026-54204` · CVE record: Tobit Laboratories AG TeamDavid · CVSS 7.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-20 - [Unauthenticated WebSocket-to-XAdES SSRF in Revenue Administration's E-Signature](https://agentprime.io/advisories/CVE-2026-16027.md) `CVE-2026-16027` · CVE record: Revenue Administration E-Signature · CVSS 5.4 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources](https://agentprime.io/advisories/CVE-2026-62857.md) `CVE-2026-62857` · CVE record: fedify-dev fedify · CVSS 8.8 High · Not analysed yet · Published 6 Aug 2026 · Tags: Server-side request forgery (SSRF) - [WGDashboard Server-Side Request Forgery Vulnerability](https://agentprime.io/advisories/CVE-2026-15732.md) `CVE-2026-15732` · CVE record: WGDashboard WGDashboard · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL](https://agentprime.io/advisories/CVE-2026-53983.md) `CVE-2026-53983` · CVE record: Efstratios Goudelis Ground Station · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery (SSRF) in eScriptorium](https://agentprime.io/advisories/CVE-2026-18359.md) `CVE-2026-18359` · CVE record: Scripta eScriptorium · CVSS 8.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Eclipse Foundation Eclipse GlassFish](https://agentprime.io/advisories/CVE-2026-12605.md) `CVE-2026-12605` · CVE record: Eclipse Foundation Eclipse GlassFish · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: Server-side request forgery (SSRF) - [MissionSquad mcp-api dcrClients.ts server-side request forgery](https://agentprime.io/advisories/CVE-2026-19040.md) `CVE-2026-19040` · CVE record: MissionSquad mcp-api · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Blind SSRF on Foxit PDF Services API](https://agentprime.io/advisories/CVE-2026-18597.md) `CVE-2026-18597` · CVE record: Foxit Software Inc. Foxit PDF Services API · CVSS 8.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler](https://agentprime.io/advisories/CVE-2026-16268.md) `CVE-2026-16268` · CVE record: Unknown Newsletters · CVSS 8.2 High · Not analysed yet · Published 6 Aug 2026 · Tags: Server-side request forgery (SSRF) - [JeecgBoot Anonymous Chat Attachment send server-side request forgery](https://agentprime.io/advisories/CVE-2026-19000.md) `CVE-2026-19000` · CVE record: JeecgBoot · CVSS 6.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Server-side request forgery (SSRF) - [heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery](https://agentprime.io/advisories/CVE-2026-18973.md) `CVE-2026-18973` · CVE record: heshengtao super-agent-party · CVSS 6.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Langflow OSS is affected by server-side request forgery in provider validation and API request functionality](https://agentprime.io/advisories/CVE-2026-9081.md) `CVE-2026-9081` · CVE record: IBM Langflow OSS · CVSS 7.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Langflow OSS is affected by server-side request forgery in provider validation and API request functionality](https://agentprime.io/advisories/CVE-2026-7657.md) `CVE-2026-7657` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator](https://agentprime.io/advisories/CVE-2026-17617.md) `CVE-2026-17617` · CVE record: IBM Application Gateway Operator · CVSS 8.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Electron: HTTP redirect followed into local file loader](https://agentprime.io/advisories/GHSA-v64r-4m7r-3mvq.md) `GHSA-v64r-4m7r-3mvq`, `CVE-2026-70605` · npm `electron`: affected `<39.8.8 || >=40.0.0-alpha.1, <40.9.1 || >=41.0.0-alpha.1, <41.2.1 || >=42.0.0-alpha.1, <42.0.0-beta.3`, fixed in `39.8.8`, `40.9.1`, `41.2.1`, `42.0.0-beta.3` · CVSS 5.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Progress MarkLogic Server](https://agentprime.io/advisories/CVE-2026-9203.md) `CVE-2026-9203` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 8.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Ghost: Server-Side Request Forgery Mitigation Issue](https://agentprime.io/advisories/GHSA-x5mm-wm4g-j5xv.md) `GHSA-x5mm-wm4g-j5xv`, `BIT-ghost-2026-70595`, `CVE-2026-70595` · npm `ghost`: affected `>=6.26.0, <6.54.1`, fixed in `6.54.1` · CVSS 4.0 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch](https://agentprime.io/advisories/CVE-2026-71280.md) `CVE-2026-71280` · CVE record: go-shiori shiori · CVSS 8.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass](https://agentprime.io/advisories/CVE-2026-71271.md) `CVE-2026-71271` · CVE record: usememos memos · CVSS 8.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess](https://agentprime.io/advisories/CVE-2026-71270.md) `CVE-2026-71270` · CVE record: Stirling-Tools Stirling-PDF · CVSS 8.6 High · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding](https://agentprime.io/advisories/CVE-2026-71250.md) `CVE-2026-71250` · CVE record: firefly-iii firefly-iii · CVSS 4.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Pixelfed - Authenticated SSRF via Remote URL Search](https://agentprime.io/advisories/CVE-2026-71246.md) `CVE-2026-71246` · CVE record: pixelfed pixelfed · CVSS 4.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host](https://agentprime.io/advisories/CVE-2026-71244.md) `CVE-2026-71244` · CVE record: paperless-ngx paperless-ngx · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [MLflow AI Gateway permits SSRF through an unvalidated api_base](https://agentprime.io/advisories/GHSA-h7x2-h6g9-p789.md) `GHSA-h7x2-h6g9-p789`, `CVE-2026-71211`, `PYSEC-2026-3865` · PyPI `mlflow`: affected `>=3.13.0, <=3.15.2`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation](https://agentprime.io/advisories/CVE-2026-71208.md) `CVE-2026-71208` · CVE record: kubesphere KubeSphere · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery](https://agentprime.io/advisories/CVE-2026-18856.md) `CVE-2026-18856` · CVE record: Poesis Rhymix CMS · CVSS 5.1 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Ghost: Server-Side Request Forgery in Image Fetching](https://agentprime.io/advisories/GHSA-gcvv-72q8-9v76.md) `GHSA-gcvv-72q8-9v76`, `BIT-ghost-2026-70591`, `CVE-2026-70591` · npm `ghost`: affected `>=0.10.0, <6.54.1`, fixed in `6.54.1` · CVSS 4.1 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Ghost: Mobiledoc image-size fetch SSRF](https://agentprime.io/advisories/GHSA-g366-23fw-ggp6.md) `GHSA-g366-23fw-ggp6`, `BIT-ghost-2026-53946`, `CVE-2026-53946` · npm `ghost`: affected `>=6.19.4, <6.21.2`, fixed in `6.21.2` · CVSS 5.4 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Ghost: Server-side request forgery via DNS rebinding in external request handling](https://agentprime.io/advisories/GHSA-ch52-px8q-f22j.md) `GHSA-ch52-px8q-f22j`, `BIT-ghost-2026-53945`, `CVE-2026-53945` · npm `ghost`: affected `>=6.0.9, <6.21.2`, fixed in `6.21.2` · CVSS 4.0 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Race condition, Server-side request forgery (SSRF) - [Odysseus SSRF via Embedding Endpoint Configuration](https://agentprime.io/advisories/CVE-2026-70620.md) `CVE-2026-70620` · CVE record: odysseus-dev odysseus · CVSS 6.1 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Ghost: Private IP filtering bypass to make server-side requests to internal services](https://agentprime.io/advisories/GHSA-wvp2-4qqp-4h3r.md) `GHSA-wvp2-4qqp-4h3r`, `BIT-ghost-2026-53944`, `CVE-2026-53944` · npm `ghost`: affected `>=6.0.9, <6.21.1`, fixed in `6.21.1` · CVSS 5.8 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-184 - [Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON](https://agentprime.io/advisories/CVE-2026-66901.md) `CVE-2026-66901` · CVE record: CJCOLLIER Google::Auth · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: Information disclosure, Server-side request forgery (SSRF) - [Open WebUI: DNS Rebinding SSRF Bypass](https://agentprime.io/advisories/GHSA-h6x2-583h-x99r.md) `GHSA-h6x2-583h-x99r`, `CVE-2026-54020`, `PYSEC-2026-3647` · PyPI `open-webui`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 6.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Race condition, Server-side request forgery (SSRF) - [Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs](https://agentprime.io/advisories/GHSA-8x5v-cpv7-8jjp.md) `GHSA-8x5v-cpv7-8jjp`, `CVE-2026-70485`, `PYSEC-2026-3645` · PyPI `open-webui`: affected `>=0.9.0, <0.11.0`, fixed in `0.11.0` · CVSS 7.1 High · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering](https://agentprime.io/advisories/GHSA-rffm-9q57-q649.md) `GHSA-rffm-9q57-q649`, `CVE-2026-70480`, `PYSEC-2026-3651` · PyPI `open-webui`: affected `>=0.6.34, <0.11.0`, fixed in `0.11.0` · CVSS 4.1 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader](https://agentprime.io/advisories/GHSA-w2rx-84hp-gg95.md) `GHSA-w2rx-84hp-gg95`, `CVE-2026-70479`, `PYSEC-2026-3653` · PyPI `open-webui`: affected `>=0.9.6, <0.11.0`, fixed in `0.11.0` · CVSS 7.7 High · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing](https://agentprime.io/advisories/GHSA-wvqv-fj8w-qmhm.md) `GHSA-wvqv-fj8w-qmhm`, `BIT-django-2026-15307`, `CVE-2026-15307`, `PYSEC-2026-4035` · PyPI `django`: affected `<5.2.17 || >=6.0a1, <6.0.8`, fixed in `5.2.17`, `6.0.8` · CVSS 8.7 High · Not analysed yet · Published 4 Aug 2026 · Tags: Path traversal, Server-side request forgery (SSRF) - [Server-side request forgery in NVIDIA Dynamo](https://agentprime.io/advisories/CVE-2026-47618.md) `CVE-2026-47618` · CVE record: NVIDIA Dynamo · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in NVIDIA Dynamo](https://agentprime.io/advisories/CVE-2026-47617.md) `CVE-2026-47617` · CVE record: NVIDIA Dynamo · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in NVIDIA Dynamo](https://agentprime.io/advisories/CVE-2026-47616.md) `CVE-2026-47616` · CVE record: NVIDIA Dynamo · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in NVIDIA Dynamo](https://agentprime.io/advisories/CVE-2026-47615.md) `CVE-2026-47615` · CVE record: NVIDIA Dynamo · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in NVIDIA Dynamo](https://agentprime.io/advisories/CVE-2026-47614.md) `CVE-2026-47614` · CVE record: NVIDIA Dynamo · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in NVIDIA Dynamo](https://agentprime.io/advisories/CVE-2026-47613.md) `CVE-2026-47613` · CVE record: NVIDIA Dynamo · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery](https://agentprime.io/advisories/CVE-2026-18775.md) `CVE-2026-18775` · CVE record: NousResearch hermes-agent · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery](https://agentprime.io/advisories/CVE-2026-18774.md) `CVE-2026-18774` · CVE record: NousResearch hermes-agent · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses](https://agentprime.io/advisories/GHSA-c6xh-wv4j-ppv5.md) `GHSA-c6xh-wv4j-ppv5`, `CVE-2026-69257` · npm `flowise`: affected `<3.1.3`, fixed in `3.1.3` · CVSS 7.6 High · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-1389 - [Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services](https://agentprime.io/advisories/CVE-2026-70367.md) `CVE-2026-70367` · CVE record: Mobi-Com Polska Sp. z o.o. stunnel and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import](https://agentprime.io/advisories/CVE-2026-14939.md) `CVE-2026-14939` · CVE record: Unknown Visualizer · CVSS 6.8 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) - [EmbedPress < 4.6.1 - Unauthenticated Blind SSRF](https://agentprime.io/advisories/CVE-2026-10526.md) `CVE-2026-10526` · CVE record: Unknown EmbedPress · CVSS 5.8 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Server-side request forgery (SSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .