# Server-side request forgery (SSRF). The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via \`endpoints/payments/search.php\`](https://agentprime.io/advisories/CVE-2026-77348.md) `CVE-2026-77348` · CVE record: ellite Wallos · CVSS 8.2 High · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-441, CWE-1188 - [Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings](https://agentprime.io/advisories/CVE-2026-77351.md) `CVE-2026-77351` · CVE record: ellite Wallos · CVSS 3.5 Low · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Wallos: SSRF via OIDC Token/UserInfo URL Configuration](https://agentprime.io/advisories/CVE-2026-61640.md) `CVE-2026-61640` · CVE record: ellite Wallos · CVSS 8.5 High · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port](https://agentprime.io/advisories/CVE-2026-61638.md) `CVE-2026-61638` · CVE record: ellite Wallos · CVSS 8.2 High · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-82852.md) `CVE-2026-82852` · CVE record: MapSVG MapSVG · CVSS 5.4 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [elFinder: SSRF protection bypass via DNS rebinding in the \`fsock_get_contents()\` fallback](https://agentprime.io/advisories/GHSA-8x3q-jpjh-qh5c.md) `GHSA-8x3q-jpjh-qh5c`, `CVE-2026-81889`, `PKSA-r7xr-47v5-58tx` · Packagist `studio-42/elfinder`: affected `<2.1.70`, fixed in `2.1.70` · CVSS 8.6 High · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery](https://agentprime.io/advisories/CVE-2026-82905.md) `CVE-2026-82905` · CVE record: sdcb chats · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs](https://agentprime.io/advisories/CVE-2026-53507.md) `CVE-2026-53507` · CVE record: oasdiff oasdiff-action · CVSS 8.3 High · Not analysed yet · Published 31 Aug 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-1188 - [MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)](https://agentprime.io/advisories/CVE-2026-79747.md) `CVE-2026-79747` · CVE record: samanhappy mcphub · CVSS 7.1 High · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation](https://agentprime.io/advisories/CVE-2026-79749.md) `CVE-2026-79749` · CVE record: samanhappy mcphub · CVSS 7.6 High · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery](https://agentprime.io/advisories/CVE-2026-82802.md) `CVE-2026-82802` · CVE record: NASA earthdata-search · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery](https://agentprime.io/advisories/CVE-2026-82801.md) `CVE-2026-82801` · CVE record: NASA earthdata-search · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery](https://agentprime.io/advisories/CVE-2026-82667.md) `CVE-2026-82667` · CVE record: yaojingang GEOFlow · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Apache Shiro: Server-side POST request may be steered to an alternate host](https://agentprime.io/advisories/CVE-2026-58301.md) `CVE-2026-58301` · CVE record: Apache Software Foundation Apache Shiro · CVSS 5.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery](https://agentprime.io/advisories/CVE-2026-82630.md) `CVE-2026-82630` · CVE record: PowerJob · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803.](https://agentprime.io/advisories/CVE-2026-51152.md) `CVE-2026-51152` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery](https://agentprime.io/advisories/CVE-2026-82556.md) `CVE-2026-82556` · CVE record: Forgejo · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Server-side request forgery (SSRF) - [jina-ai reader Server-Side Request Forgery via disabled private-address guard](https://agentprime.io/advisories/CVE-2026-82638.md) `CVE-2026-82638` · CVE record: jina-ai reader · CVSS 8.7 High · Not analysed yet · Published 30 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Memos through 0.30.0 SSRF via Omitted CGNAT Address Range](https://agentprime.io/advisories/CVE-2026-82476.md) `CVE-2026-82476` · CVE record: usememos memos · CVSS 6.9 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in MITRE Heimdall](https://agentprime.io/advisories/CVE-2026-82477.md) `CVE-2026-82477` · CVE record: MITRE Heimdall · CVSS 5.8 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password](https://agentprime.io/advisories/CVE-2026-77012.md) `CVE-2026-77012` · CVE record: Unknown 爱采集数据采集和发布插件 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure](https://agentprime.io/advisories/CVE-2026-16947.md) `CVE-2026-16947` · CVE record: Unknown Total processing card payments for WooCommerce · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Aug 2026 · Tags: Server-side request forgery (SSRF) - [SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image](https://agentprime.io/advisories/CVE-2026-16600.md) `CVE-2026-16600` · CVE record: Unknown SmartAIPress · CVSS 7.7 High · Not analysed yet · Published 29 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities](https://agentprime.io/advisories/CVE-2026-18545.md) `CVE-2026-18545` · CVE record: IBM Langflow OSS · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [9router: Unauthenticated \`/v1\` proxy access via \`Host\`-header spoofing → open AI relay + SSRF](https://agentprime.io/advisories/GHSA-86m2-fcxq-5q7c.md) `GHSA-86m2-fcxq-5q7c`, `CVE-2026-55641` · npm `9router`: affected `<0.5.2`, fixed in `0.5.2` · CVSS 8.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF), CWE-348, CWE-1327 - [Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL](https://agentprime.io/advisories/GHSA-w98g-5w9p-p3rc.md) `GHSA-w98g-5w9p-p3rc`, `CVE-2026-55245`, `GO-2026-6320` · Go `github.com/maximhq/bifrost/core`: affected `<1.5.17`, fixed in `1.5.17` · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure](https://agentprime.io/advisories/CVE-2026-82289.md) `CVE-2026-82289` · CVE record: coderamp-labs gitingest · CVSS 8.3 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback](https://agentprime.io/advisories/CVE-2026-82285.md) `CVE-2026-82285` · CVE record: dataelement bisheng · CVSS 8.8 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/\*](https://agentprime.io/advisories/CVE-2026-82270.md) `CVE-2026-82270` · CVE record: Portkey-AI gateway · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL](https://agentprime.io/advisories/CVE-2026-82268.md) `CVE-2026-82268` · CVE record: QwenLM Qwen-Agent · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL](https://agentprime.io/advisories/CVE-2026-82263.md) `CVE-2026-82263` · CVE record: logto-io logto · CVSS 8.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Logto Server-Side Request Forgery via webhook test endpoint](https://agentprime.io/advisories/CVE-2026-82262.md) `CVE-2026-82262` · CVE record: logto-io logto · CVSS 8.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /\_proxy/ route, bypasses ENABLE_AUTHZ=true](https://agentprime.io/advisories/CVE-2026-54745.md) `CVE-2026-54745` · CVE record: kubeflow pipelines · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Broken access control, Server-side request forgery (SSRF) - [Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'](https://agentprime.io/advisories/CVE-2026-5096.md) `CVE-2026-5096` · CVE record: wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI · CVSS 5.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Budibase Server before 3.41.3 SSRF via Query Import](https://agentprime.io/advisories/CVE-2026-82246.md) `CVE-2026-82246` · CVE record: budibase server · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Budibase Server before 3.41.3 SSRF with Credential Leakage](https://agentprime.io/advisories/CVE-2026-82243.md) `CVE-2026-82243` · CVE record: budibase server · CVSS 8.3 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Budibase backend-core SSRF via incomplete default blacklist](https://agentprime.io/advisories/CVE-2026-82241.md) `CVE-2026-82241` · CVE record: budibase server · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in Synology Chat Server](https://agentprime.io/advisories/CVE-2026-9491.md) `CVE-2026-9491` · CVE record: Synology Synology Chat Server · CVSS 4.3 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in wallabag](https://agentprime.io/advisories/CVE-2026-82081.md) `CVE-2026-82081` · CVE record: wallabag wallabag · CVSS 6.4 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Dimension Server-Side Request Forgery via Email Server Test Settings](https://agentprime.io/advisories/CVE-2026-78498.md) `CVE-2026-78498` · CVE record: WatchGuard Dimension · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Dimension Server-Side Request Forgery via Remote Backup Connection Test](https://agentprime.io/advisories/CVE-2026-78495.md) `CVE-2026-78495` · CVE record: WatchGuard Dimension · CVSS 5.3 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Dimension SSRF via FTP Server Test Connection](https://agentprime.io/advisories/CVE-2026-78499.md) `CVE-2026-78499` · CVE record: WatchGuard Dimension · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Dimension Blind SSRF via Database Test Connection Feature](https://agentprime.io/advisories/CVE-2026-78500.md) `CVE-2026-78500` · CVE record: WatchGuard Dimension · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-208 - [cyberchitta scrapling-fetch-mcp \_fetcher.py s_fetch_pattern server-side request forgery](https://agentprime.io/advisories/CVE-2026-81848.md) `CVE-2026-81848` · CVE record: cyberchitta scrapling-fetch-mcp · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function](https://agentprime.io/advisories/CVE-2026-59291.md) `CVE-2026-59291` · CVE record: Spring Spring Cloud Function · CVSS 2.0 Low · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection](https://agentprime.io/advisories/CVE-2026-55758.md) `CVE-2026-55758` · CVE record: cc-tweaked CC-Tweaked · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery (SSRF) in GitLab AI Gateway](https://agentprime.io/advisories/CVE-2026-75871.md) `CVE-2026-75871` · CVE record: GitLab GitLab AI Gateway · CVSS 8.2 High · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery (SSRF) in GitLab AI Gateway](https://agentprime.io/advisories/CVE-2026-19889.md) `CVE-2026-19889` · CVE record: GitLab GitLab AI Gateway · CVSS 8.2 High · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [AVideo SSRF Guard Bypass via IPv6 Transition Addresses](https://agentprime.io/advisories/CVE-2026-81678.md) `CVE-2026-81678` · CVE record: WWBN AVideo · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton](https://agentprime.io/advisories/CVE-2026-81093.md) `CVE-2026-81093` · CVE record: apify actors-mcp-server · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL](https://agentprime.io/advisories/CVE-2026-81091.md) `CVE-2026-81091` · CVE record: mcp-use mcp-use · CVSS 8.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages](https://agentprime.io/advisories/CVE-2026-59278.md) `CVE-2026-59278` · CVE record: Spring Spring for Apache Kafka · CVSS 6.5 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Spring Cloud Gateway SSRF and native file access with gRPC](https://agentprime.io/advisories/CVE-2026-47879.md) `CVE-2026-47879` · CVE record: Spring Spring Cloud Gateway · CVSS 7.7 High · Not analysed yet · Published 27 Aug 2026 · Tags: Server-side request forgery (SSRF) - [UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false](https://agentprime.io/advisories/CVE-2026-47861.md) `CVE-2026-47861` · CVE record: Spring Spring Integration · CVSS 6.3 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Server-side request forgery (SSRF) - [ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery](https://agentprime.io/advisories/CVE-2026-81421.md) `CVE-2026-81421` · CVE record: ddfourtwo sentry-selfhosted-mcp · CVSS 6.9 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Server-side request forgery (SSRF) - [HCL Connections is vulnerable to server-side request forgery (SSRF)](https://agentprime.io/advisories/CVE-2025-62341.md) `CVE-2025-62341` · CVE record: HCLSoftware Connections · CVSS 3.7 Low · Not analysed yet · Published 26 Aug 2026 · Tags: Server-side request forgery (SSRF) - [Weblate: DNS rebinding in VCS operations allows server-side request forgery](https://agentprime.io/advisories/CVE-2026-77573.md) `CVE-2026-77573` · CVE record: WeblateOrg weblate · CVSS 3.5 Low · Not analysed yet · Published 26 Aug 2026 · Tags: Race condition, Server-side request forgery (SSRF) - [Server-side request forgery in Dell Cloud Disaster Recovery](https://agentprime.io/advisories/CVE-2026-71172.md) `CVE-2026-71172` · CVE record: Dell Cloud Disaster Recovery · CVSS 4.3 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: Server-side request forgery (SSRF) - [OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL](https://agentprime.io/advisories/CVE-2026-80350.md) `CVE-2026-80350` · CVE record: OneUptime OneUptime · CVSS 7.1 High · Not analysed yet · Published 26 Aug 2026 · Tags: Server-side request forgery (SSRF) - [mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets](https://agentprime.io/advisories/CVE-2026-80347.md) `CVE-2026-80347` · CVE record: kazuph mcp-fetch · CVSS 8.7 High · Not analysed yet · Published 26 Aug 2026 · Tags: Server-side request forgery (SSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .