# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).](https://agentprime.io/advisories/CVE-2026-75340.md)
  `CVE-2026-75340` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().](https://agentprime.io/advisories/CVE-2026-75332.md)
  `CVE-2026-75332` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access](https://agentprime.io/advisories/GHSA-hvfh-5mj3-5f3j.md)
  `GHSA-hvfh-5mj3-5f3j`, `CVE-2026-120492`, `CVE-2026-45019`, `PYSEC-2026-3811` · PyPI `chainlit`: affected `>=2.4.0rc0, <2.12.0`, fixed in `2.12.0` · CVSS 6.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address](https://agentprime.io/advisories/CVE-2026-79788.md)
  `CVE-2026-79788` · CVE record: dradis dradis-ce · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-76193.md)
  `CVE-2026-76193` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [utcp-http has an OAuth2 \`tokenUrl\` Trust Boundary Bypass in OpenAPI Conversion](https://agentprime.io/advisories/GHSA-8cp3-qxj6-px34.md)
  `GHSA-8cp3-qxj6-px34` · PyPI `utcp-http`: affected `<1.1.4`, fixed in `1.1.4` · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins](https://agentprime.io/advisories/GHSA-ppx3-28rw-8fpf.md)
  `GHSA-ppx3-28rw-8fpf`, `CVE-2026-12210`, `PYSEC-2026-3931`, `PYSEC-2026-3932` · PyPI `utcp-gql` and 1 more: affected `<1.1.1`, fixed in `1.1.1` · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target](https://agentprime.io/advisories/GHSA-9qhg-99ww-9mqc.md)
  `GHSA-9qhg-99ww-9mqc` · PyPI `utcp-http`: affected `<1.1.4`, fixed in `1.1.4` · CVSS 8.2 High · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [SSRF In CocoaPods Via JFrog Artifactory External Dependency](https://agentprime.io/advisories/CVE-2026-70548.md)
  `CVE-2026-70548` · CVE record: jfrog artifactory · CVSS 3.5 Low · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery Via VCS remote download in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-70551.md)
  `CVE-2026-70551` · CVE record: jfrog artifactory · CVSS 8.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation](https://agentprime.io/advisories/GHSA-hmfx-4v44-9qw9.md)
  `GHSA-hmfx-4v44-9qw9`, `CVE-2026-55535`, `PYSEC-2026-3890` · PyPI `praisonai`: affected `<4.6.58`, fixed in `4.6.58` · CVSS 6.8 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [PraisonAI: Webhook SSRF via DNS fail-open in \`JobSubmitRequest.validate_webhook_url()\` — bypass of CVE-2026-40114](https://agentprime.io/advisories/GHSA-rg5q-pp8p-f7jm.md)
  `GHSA-rg5q-pp8p-f7jm`, `CVE-2026-55537`, `PYSEC-2026-3895` · PyPI `praisonai`: affected `<4.6.58`, fixed in `4.6.58` · CVSS 7.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Race condition, Server-side request forgery (SSRF), CWE-705
- [Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction](https://agentprime.io/advisories/CVE-2026-79717.md)
  `CVE-2026-79717` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 · CVSS 6.4 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)](https://agentprime.io/advisories/GHSA-vg6p-v9vm-6fgj.md)
  `GHSA-vg6p-v9vm-6fgj`, `CVE-2026-55524`, `PYSEC-2026-3904` · PyPI `praisonaiagents`: affected `<1.6.58`, fixed in `1.6.58` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [praisonaiagents has an SSRF protection bypass in \`spider_tools.\_host_is_blocked()\` via DNS-resolved hostnames (\`127.0.0.1.nip.io\`)](https://agentprime.io/advisories/GHSA-x44h-65qv-cw74.md)
  `GHSA-x44h-65qv-cw74`, `CVE-2026-55526`, `PYSEC-2026-3905` · PyPI `praisonaiagents`: affected `<1.6.58`, fixed in `1.6.58` · CVSS 8.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-350
- [praisonaiagents has a \`web_crawl\` SSRF protection bypass via unchecked redirect targets](https://agentprime.io/advisories/GHSA-8hjw-25cg-g52h.md)
  `GHSA-8hjw-25cg-g52h`, `CVE-2026-55523`, `PYSEC-2026-3900` · PyPI `praisonaiagents`: affected `>=1.5.128, <1.6.58`, fixed in `1.6.58` · CVSS 7.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [praisonaiagents web_crawl vulnerable to SSRF via redirect-following](https://agentprime.io/advisories/GHSA-5r34-2g38-6569.md)
  `GHSA-5r34-2g38-6569`, `CVE-2026-55525`, `PYSEC-2026-3898` · PyPI `praisonaiagents`: affected `<1.6.58`, fixed in `1.6.58` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url](https://agentprime.io/advisories/CVE-2026-55976.md)
  `CVE-2026-55976` · CVE record: Apache Software Foundation Apache Hive · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Duplicate Advisory: pathsec SSRF protection can be bypassed when a proxy is configured](https://agentprime.io/advisories/GHSA-crp9-r7rq-c8cg.md)
  `GHSA-crp9-r7rq-c8cg` · PyPI `nltk`: affected `<=3.10.2`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Adminer before 5.5.0 SSRF via PDO DSN Injection](https://agentprime.io/advisories/CVE-2026-34964.md)
  `CVE-2026-34964` · CVE record: vrana adminer · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects](https://agentprime.io/advisories/CVE-2026-76838.md)
  `CVE-2026-76838` · CVE record: HiEventsDev Hi.Events · CVSS 8.4 High · Not analysed yet · Published 24 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Awx: notification backends allow ssrf and credential leakage](https://agentprime.io/advisories/CVE-2026-71366.md)
  `CVE-2026-71366` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 7.7 High · Not analysed yet · Published 24 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access](https://agentprime.io/advisories/CVE-2026-78385.md)
  `CVE-2026-78385` · CVE record: ransomlook ransomlook · CVSS 8.2 High · Not analysed yet · Published 24 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-78277.md)
  `CVE-2026-78277` · CVE record: WP ManageNinja LLC FluentCRM Pro · CVSS 4.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-78269.md)
  `CVE-2026-78269` · CVE record: Tammersoft Shared Files · CVSS 6.4 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation](https://agentprime.io/advisories/CVE-2026-10582.md)
  `CVE-2026-10582` · CVE record: gohugoio hugo · CVSS 8.3 High · Not analysed yet · Published 24 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space](https://agentprime.io/advisories/CVE-2026-78205.md)
  `CVE-2026-78205` · CVE record: bentoml BentoML · CVSS 6.9 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery](https://agentprime.io/advisories/CVE-2026-78061.md)
  `CVE-2026-78061` · CVE record: vas3k TaxHacker · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Duplicate Advisory: nltk: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure](https://agentprime.io/advisories/GHSA-qg9p-xrhj-435m.md)
  `GHSA-qg9p-xrhj-435m` · PyPI `nltk`: affected `<=3.9.4`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 22 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys](https://agentprime.io/advisories/CVE-2026-78003.md)
  `CVE-2026-78003` · CVE record: mailgun Mailgun for WordPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers](https://agentprime.io/advisories/GHSA-5vf6-jrqr-78fj.md)
  `GHSA-5vf6-jrqr-78fj`, `CVE-2026-63004` · npm `unleash-server`: affected `<7.5.2 || >=7.6.0, <7.6.5 || >=8.0.0, <8.0.2`, fixed in `7.5.2`, `7.6.5`, `8.0.2` · CVSS 5.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [OpenViking < 0.3.4 SSRF via /api/v1/resources](https://agentprime.io/advisories/CVE-2026-22681.md)
  `CVE-2026-22681` · CVE record: Volcengine OpenViking · CVSS 8.3 High · Not analysed yet · Published 21 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Azure SQL Database Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69502.md)
  `CVE-2026-69502` · CVE record: Microsoft Azure SQL Database · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-13176.md)
  `CVE-2026-13176` · CVE record: Unknown Eventin · CVSS 2.7 Low · Not analysed yet · Published 21 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation](https://agentprime.io/advisories/CVE-2026-77775.md)
  `CVE-2026-77775` · CVE record: Headroom Labs Headroom · CVSS 7.7 High · Not analysed yet · Published 21 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates](https://agentprime.io/advisories/CVE-2026-50112.md)
  `CVE-2026-50112` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.8 High · Not analysed yet · Published 21 Aug 2026 · Tags: Command injection, Server-side request forgery (SSRF)
- [Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module](https://agentprime.io/advisories/CVE-2026-59085.md)
  `CVE-2026-59085` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate](https://agentprime.io/advisories/CVE-2026-61422.md)
  `CVE-2026-61422` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in OpenStack Glance](https://agentprime.io/advisories/CVE-2026-77648.md)
  `CVE-2026-77648` · CVE record: OpenStack Glance · CVSS 2.2 Low · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Server Side Request Forgery (SSRF) vulnerability reported in Windchill](https://agentprime.io/advisories/CVE-2026-77646.md)
  `CVE-2026-77646` · CVE record: PTC Windchill PDMLink and 1 more · CVSS 7.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Insecure deserialization, Server-side request forgery (SSRF)
- [langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-72848.md)
  `CVE-2026-72848` · CVE record: langchain-ai langchain-community · CVSS 7.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-72846.md)
  `CVE-2026-72846` · CVE record: lightdash lightdash · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Copilot in Azure Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-69855.md)
  `CVE-2026-69855` · CVE record: Microsoft Microsoft Copilot in Azure · CVSS 7.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Azure Virtual Machines Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69543.md)
  `CVE-2026-69543` · CVE record: Microsoft Azure Virtual Machines · CVSS 8.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Azure Data Factory Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-66800.md)
  `CVE-2026-66800` · CVE record: Microsoft Azure Data Factory · CVSS 8.6 High · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution](https://agentprime.io/advisories/CVE-2026-54508.md)
  `CVE-2026-54508` · CVE record: mauriceboe TREK · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Entra ID Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69851.md)
  `CVE-2026-69851` · CVE record: Microsoft Microsoft Entra · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Exchange Online Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-65801.md)
  `CVE-2026-65801` · CVE record: Microsoft Microsoft Exchange Online · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable](https://agentprime.io/advisories/CVE-2026-72860.md)
  `CVE-2026-72860` · CVE record: decolua 9router · CVSS 6.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-184
- [stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address](https://agentprime.io/advisories/GHSA-5p3m-vhh6-9236.md)
  `GHSA-5p3m-vhh6-9236`, `CVE-2026-76239` · PyPI `stigmem-node`: affected `<0.9.0a11`, fixed in `0.9.0a11` · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-20
- [Apache InLong: Authenticated SSRF via POST /api/node/testConnection](https://agentprime.io/advisories/CVE-2026-63044.md)
  `CVE-2026-63044` · CVE record: Apache Software Foundation Apache InLong · CVSS 5.4 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery in ATutor](https://agentprime.io/advisories/CVE-2026-64968.md)
  `CVE-2026-64968` · CVE record: ATutor ATutor · CVSS 5.1 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool](https://agentprime.io/advisories/CVE-2026-77085.md)
  `CVE-2026-77085` · CVE record: n8n-io n8n · CVSS 6.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [n8n before 1.123.69 SSRF Protection Bypass via OAuth2](https://agentprime.io/advisories/CVE-2026-77069.md)
  `CVE-2026-77069` · CVE record: n8n-io n8n · CVSS 2.3 Low · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation](https://agentprime.io/advisories/CVE-2026-77067.md)
  `CVE-2026-77067` · CVE record: omnivore-app omnivore · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query](https://agentprime.io/advisories/CVE-2026-77066.md)
  `CVE-2026-77066` · CVE record: omnivore-app omnivore · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery](https://agentprime.io/advisories/CVE-2026-76795.md)
  `CVE-2026-76795` · CVE record: AeternaLabsHQ PullMD · CVSS 6.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery (SSRF) through the REST API in Splunk Connect for Kafka](https://agentprime.io/advisories/CVE-2026-76402.md)
  `CVE-2026-76402` · CVE record: Splunk Splunk Connect for Kafka · CVSS 8.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud](https://agentprime.io/advisories/CVE-2026-76389.md)
  `CVE-2026-76389` · CVE record: Splunk Cisco Talos Intelligence for Enterprise Security Cloud · CVSS 8.8 High · Not analysed yet · Published 19 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76361.md)
  `CVE-2026-76361` · CVE record: Splunk Splunk SOAR · CVSS 2.7 Low · Not analysed yet · Published 19 Aug 2026 · Tags: Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI2LTA4LTE5VDIxOjM0OjUxLjY2OTAwMFoiLCJDVkUtMjAyNi03NjM2MSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI2LTA4LTI2VDEwOjA5OjQ3Ljk3NzAwMFoiLCJDVkUtMjAyNi04MDM0NyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI2LTA4LTI2VDEwOjA5OjQ3Ljk3NzAwMFoiLCJDVkUtMjAyNi04MDM0NyJd>. Everything for agents: <https://agentprime.io/llms.txt>.