# Server-side request forgery (SSRF). The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-66704.md) `CVE-2026-66704` · CVE record: Jegstudio Gutenverse Companion · CVSS 7.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Server-side request forgery (SSRF) - [WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-66654.md) `CVE-2026-66654` · CVE record: TangibleWP Vehica Core · CVSS 6.0 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses](https://agentprime.io/advisories/CVE-2026-73629.md) `CVE-2026-73629` · CVE record: s9y Serendipity · CVSS 8.4 High · Not analysed yet · Published 13 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Meeting Room Booking System has server-side request forgery in import functionality](https://agentprime.io/advisories/CVE-2026-46382.md) `CVE-2026-46382` · CVE record: meeting-room-booking-system mrbs-code · CVSS 8.7 High · Not analysed yet · Published 12 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin](https://agentprime.io/advisories/CVE-2026-18952.md) `CVE-2026-18952` · CVE record: AWS Opensearch and 1 more · CVSS 8.6 High · Not analysed yet · Published 12 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation](https://agentprime.io/advisories/CVE-2026-73297.md) `CVE-2026-73297` · CVE record: microsoft UFO · CVSS 6.9 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Server-side request forgery (SSRF) - [WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.](https://agentprime.io/advisories/CVE-2026-65941.md) `CVE-2026-65941` · CVE record: Progress Software Corporation WhatsUp Gold · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: Path traversal, Code injection, Authentication bypass, Server-side request forgery (SSRF) - [compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0](https://agentprime.io/advisories/GHSA-h47f-gmjp-m7rr.md) `GHSA-h47f-gmjp-m7rr`, `CVE-2026-52776`, `PYSEC-2026-3659` · PyPI `compliance-trestle`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 8.6 High · Not analysed yet · Published 12 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-184 - [Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup](https://agentprime.io/advisories/CVE-2026-73432.md) `CVE-2026-73432` · CVE record: vulnerability-lookup vulnerability-lookup · CVSS 5.1 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider](https://agentprime.io/advisories/CVE-2026-73264.md) `CVE-2026-73264` · CVE record: prowler-cloud prowler · CVSS 7.6 High · Not analysed yet · Published 12 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Fortinet FortiSIEM](https://agentprime.io/advisories/CVE-2026-70467.md) `CVE-2026-70467` · CVE record: Fortinet FortiSIEM · CVSS 3.4 Low · Not analysed yet · Published 12 Aug 2026 · Tags: Server-side request forgery (SSRF) - [ProSolution WP Client < 2.0.9 - Subscriber+ SSRF via proSol_url_validate](https://agentprime.io/advisories/CVE-2026-19050.md) `CVE-2026-19050` · CVE record: Unknown ProSolution WP Client · CVSS 6.4 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL](https://agentprime.io/advisories/CVE-2026-16294.md) `CVE-2026-16294` · CVE record: Unknown PowerPress Podcasting plugin by Blubrry · CVSS 7.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: Server-side request forgery (SSRF) - [TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler](https://agentprime.io/advisories/CVE-2026-48762.md) `CVE-2026-48762` · CVE record: baptisteArno typebot.io · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass](https://agentprime.io/advisories/CVE-2026-73243.md) `CVE-2026-73243` · CVE record: kekingcn kkFileView · CVSS 5.8 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-9mrh-pw7c-9mqm.md) `GHSA-9mrh-pw7c-9mqm`, `BIT-dotnet-2026-62902`, `BIT-dotnet-sdk-2026-62902`, `CVE-2026-62902` · NuGet `Microsoft.WindowsDesktop.App.Runtime.win-arm64` and 2 more: affected `>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11`, fixed in `8.0.30`, `9.0.19`, `10.0.11` · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-693, CWE-829 - [coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE](https://agentprime.io/advisories/CVE-2026-73212.md) `CVE-2026-73212` · CVE record: coturn coturn · CVSS 5.8 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Broken access control, Server-side request forgery (SSRF) - [Microsoft SharePoint Server Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-58639.md) `CVE-2026-58639` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft SharePoint Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70326.md) `CVE-2026-70326` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70324.md) `CVE-2026-70324` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft Exchange Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-65813.md) `CVE-2026-65813` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [PowerShell Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-58612.md) `CVE-2026-58612` · CVE record: Microsoft PowerShell 7.4 and 2 more · CVSS 7.4 High · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Apache Allura: Server-side request forgery](https://agentprime.io/advisories/CVE-2026-69223.md) `CVE-2026-69223` · CVE record: Apache Software Foundation Apache Allura · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-47922.md) `CVE-2026-47922` · CVE record: Adobe Content Credentials Rust SDK and 2 more · CVSS 4.7 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Activepieces: Server-side request forgery in MCP tool validation endpoint](https://agentprime.io/advisories/CVE-2026-73082.md) `CVE-2026-73082` · CVE record: activepieces activepieces · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Information disclosure, Server-side request forgery (SSRF) - [TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server](https://agentprime.io/advisories/CVE-2026-48483.md) `CVE-2026-48483` · CVE record: baptisteArno typebot.io · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle](https://agentprime.io/advisories/GHSA-87fv-vqqr-m4jr.md) `GHSA-87fv-vqqr-m4jr`, `BIT-seaweedfs-2026-73080`, `CVE-2026-73080`, `GO-2026-6219` · Go `github.com/seaweedfs/seaweedfs`: affected `<0.0.0-20260512171120-69da20bdaec9`, fixed in `0.0.0-20260512171120-69da20bdaec9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture](https://agentprime.io/advisories/CVE-2026-73210.md) `CVE-2026-73210` · CVE record: Lookyloo PlaywrightCapture · CVSS 5.1 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation](https://agentprime.io/advisories/CVE-2026-72784.md) `CVE-2026-72784` · CVE record: craftcms cms · CVSS 6.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console](https://agentprime.io/advisories/CVE-2026-50236.md) `CVE-2026-50236` · CVE record: Red Hat Red Hat OpenShift Container Platform 4.14 and 4 more · CVSS 7.4 High · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console](https://agentprime.io/advisories/CVE-2026-50237.md) `CVE-2026-50237` · CVE record: Red Hat Red Hat OpenShift Container Platform 4.12 and 4 more · CVSS 7.4 High · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Pinry Pinry - Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-72606.md) `CVE-2026-72606` · CVE record: Pinry Pinry · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Apioo Fusio - Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-72598.md) `CVE-2026-72598` · CVE record: Apioo Fusio · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Friendica Friendica - Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-72597.md) `CVE-2026-72597` · CVE record: Friendica Friendica · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [HumanSignal Label Studio - Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-72560.md) `CVE-2026-72560` · CVE record: HumanSignal Label Studio · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Dub Dub - Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-72552.md) `CVE-2026-72552` · CVE record: Dub Dub · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/CVE-2026-13739.md) `CVE-2026-13739` · CVE record: Commvault Commvault Cloud · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses](https://agentprime.io/advisories/CVE-2026-73160.md) `CVE-2026-73160` · CVE record: MISP cti-transmute · CVSS 8.7 High · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [CVE-2026-19516 CVE Record](https://agentprime.io/advisories/CVE-2026-19516.md) `CVE-2026-19516` · CVE record: Grafana Grafana MCP Server and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by sett…](https://agentprime.io/advisories/CVE-2026-51583.md) `CVE-2026-51583` · CVE record · CVSS 8.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses](https://agentprime.io/advisories/CVE-2026-72916.md) `CVE-2026-72916` · CVE record: mastodon mastodon · CVSS 6.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-1286 - [Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup](https://agentprime.io/advisories/CVE-2026-72761.md) `CVE-2026-72761` · CVE record: vulnerability-lookup vulnerability-lookup · CVSS 6.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter](https://agentprime.io/advisories/CVE-2026-72591.md) `CVE-2026-72591` · CVE record: gabehf Koito · CVSS 7.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: Server-side request forgery (SSRF) - [duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint](https://agentprime.io/advisories/CVE-2026-72581.md) `CVE-2026-72581` · CVE record: duhow xiaoai-patch · CVSS 8.6 High · Not analysed yet · Published 10 Aug 2026 · Tags: Server-side request forgery (SSRF) - [automatisch - Server-Side Request Forgery via HTTP Request Custom Action](https://agentprime.io/advisories/CVE-2026-72566.md) `CVE-2026-72566` · CVE record: automatisch automatisch · CVSS 7.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: Server-side request forgery (SSRF) - [All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter](https://agentprime.io/advisories/CVE-2026-19075.md) `CVE-2026-19075` · CVE record: Unknown All-in-One Video Gallery · CVSS 5.0 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-14860.md) `CVE-2026-14860` · CVE record: Unknown Podcast Player · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Server-side request forgery (SSRF) - [LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature](https://agentprime.io/advisories/CVE-2026-12971.md) `CVE-2026-12971` · CVE record: Unknown LearnPress · CVSS 2.2 Low · Not analysed yet · Published 10 Aug 2026 · Tags: Server-side request forgery (SSRF) - [A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The \`nltk.pathsec.validate_network_url()\` function, intended to prevent SSRF by...](https://agentprime.io/advisories/GHSA-2jhm-w3mp-jcwr.md) `GHSA-2jhm-w3mp-jcwr`, `CVE-2026-12372`, `PYSEC-2026-3955` · PyPI `nltk`: affected `<=3.9.4`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 9 Aug 2026 · Tags: Server-side request forgery (SSRF) - [dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery](https://agentprime.io/advisories/CVE-2026-19375.md) `CVE-2026-19375` · CVE record: dmitriiweb article-scraper-mcp · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Server-side request forgery (SSRF) - [adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery](https://agentprime.io/advisories/CVE-2026-19374.md) `CVE-2026-19374` · CVE record: adafap api-mcp · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Server-side request forgery (SSRF) - [PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery](https://agentprime.io/advisories/CVE-2026-19373.md) `CVE-2026-19373` · CVE record: PhialsBasement KoboldCPP-MCP-Server · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Server-side request forgery (SSRF) - [KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get server-side request forgery](https://agentprime.io/advisories/CVE-2026-19369.md) `CVE-2026-19369` · CVE record: KS-GEN-AI jira-mcp-server · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Server-side request forgery (SSRF) - [NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgery](https://agentprime.io/advisories/CVE-2026-19367.md) `CVE-2026-19367` · CVE record: NocteDefensor LudusMCP · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Server-side request forgery (SSRF) - [mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery](https://agentprime.io/advisories/CVE-2026-19352.md) `CVE-2026-19352` · CVE record: mifi lossless-cut · CVSS 2.3 Low · Not analysed yet · Published 9 Aug 2026 · Tags: Server-side request forgery (SSRF) - [anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery](https://agentprime.io/advisories/CVE-2026-19340.md) `CVE-2026-19340` · CVE record: anubissbe ProjectHub-Mcp · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Server-side request forgery (SSRF) - [aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequestSchema server-side request forgery](https://agentprime.io/advisories/CVE-2026-19339.md) `CVE-2026-19339` · CVE record: aliyun alibabacloud-dataworks-mcp-server · CVSS 5.3 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Server-side request forgery (SSRF) - [adenot mcp-google-search read_webpage index.ts server-side request forgery](https://agentprime.io/advisories/CVE-2026-19337.md) `CVE-2026-19337` · CVE record: adenot mcp-google-search · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List](https://agentprime.io/advisories/CVE-2026-67620.md) `CVE-2026-67620` · CVE record: FlowiseAI Flowise · CVSS 6.3 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Server-side request forgery (SSRF) - [HKUDS nanobot Provider-returned Image URL image_generation.py \_download_image_data_url server-side request forgery](https://agentprime.io/advisories/CVE-2026-19246.md) `CVE-2026-19246` · CVE record: HKUDS nanobot · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .