# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-81207.md)
  `CVE-2026-81207` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches](https://agentprime.io/advisories/CVE-2026-81213.md)
  `CVE-2026-81213` · CVE record: IBM Langflow OSS · CVSS 8.6 High · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches](https://agentprime.io/advisories/CVE-2026-81265.md)
  `CVE-2026-81265` · CVE record: IBM Langflow OSS · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-82097.md)
  `CVE-2026-82097` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content](https://agentprime.io/advisories/GHSA-q5wm-mgqx-fv2f.md)
  `GHSA-q5wm-mgqx-fv2f`, `CVE-2026-86074` · npm `n8n`: affected `<2.37.7 || >=2.38.0, <2.38.2`, fixed in `2.37.7`, `2.38.2` · CVSS 5.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-9667.md)
  `CVE-2026-9667` · CVE record: IBM WebSphere Application Server · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR](https://agentprime.io/advisories/GHSA-f6mr-pjwc-34m4.md)
  `GHSA-f6mr-pjwc-34m4`, `CVE-2026-88056` · npm `@angular/platform-server`: affected `<=19.2.25 || >=20.0.0, <20.3.30 || >=21.0.0, <21.2.22 || >=22.0.0, <22.1.4`, fixed in `20.3.30`, `21.2.22`, `22.1.4` · CVSS 8.6 High · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent](https://agentprime.io/advisories/CVE-2026-89049.md)
  `CVE-2026-89049` · CVE record: AWS Amazon SSM Agent · CVSS 8.5 High · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-1289
- [n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node](https://agentprime.io/advisories/GHSA-34ff-336r-5q23.md)
  `GHSA-34ff-336r-5q23`, `CVE-2026-86082` · npm `n8n`: affected `<1.123.76 || >=2.0.0, <2.37.7 || >=2.38.0, <2.38.2`, fixed in `1.123.76`, `2.37.7`, `2.38.2` · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader](https://agentprime.io/advisories/GHSA-4v28-j6q3-5m4r.md)
  `GHSA-4v28-j6q3-5m4r`, `CVE-2026-87996`, `PYSEC-2026-4120` · PyPI `open-webui`: affected `>=0.9.6, <0.11.1`, fixed in `0.11.1` · CVSS 7.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch](https://agentprime.io/advisories/GHSA-34r3-9m95-vq73.md)
  `GHSA-34r3-9m95-vq73`, `CVE-2026-87999`, `PYSEC-2026-4116` · PyPI `open-webui`: affected `<0.11.1`, fixed in `0.11.1` · CVSS 7.1 High · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass](https://agentprime.io/advisories/CVE-2026-88896.md)
  `CVE-2026-88896` · CVE record: espocrm espocrm · CVSS 6.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch](https://agentprime.io/advisories/CVE-2026-88892.md)
  `CVE-2026-88892` · CVE record: Openpanel-dev openpanel · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets](https://agentprime.io/advisories/GHSA-5x7x-4c3c-qf5w.md)
  `GHSA-5x7x-4c3c-qf5w`, `CVE-2026-88001`, `PYSEC-2026-3878` · PyPI `open-webui`: affected `>=0.9.5, <0.11.1`, fixed in `0.11.1` · CVSS 5.0 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Komari: Management Interface CSRF](https://agentprime.io/advisories/GHSA-hxjg-93wc-h8p8.md)
  `GHSA-hxjg-93wc-h8p8`, `GO-2026-6449` · Go `github.com/komari-monitor/komari`: affected `<0.0.0-20260609084633-98122fa4d110`, fixed in `0.0.0-20260609084633-98122fa4d110` · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool](https://agentprime.io/advisories/GHSA-5hx7-j24v-rffj.md)
  `GHSA-5hx7-j24v-rffj`, `CVE-2026-55864` · Maven `org.geonetwork-opensource:gn-web-app`: affected `>=4.4.0, <4.4.12 || >=4.0.0, <4.2.17`, fixed in `4.4.12`, `4.2.17` · CVSS 7.8 High · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [weasyprint Has Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/GHSA-jf6q-chmf-3h3v.md)
  `GHSA-jf6q-chmf-3h3v`, `CVE-2026-55073`, `PYSEC-2026-3940` · PyPI `weasyprint`: affected `<70.0`, fixed in `70.0` · CVSS 6.2 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [LF Edge eKuiper: SSRF in External Service](https://agentprime.io/advisories/GHSA-pqqc-8v73-9gg2.md)
  `GHSA-pqqc-8v73-9gg2`, `CVE-2025-24979`, `GO-2026-6447` · Go `github.com/lf-edge/ekuiper/v2`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 5.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Schneider Electric EcoStruxure™ IT Data Center Expert (Formerly known as…](https://agentprime.io/advisories/CVE-2026-19233.md)
  `CVE-2026-19233` · CVE record: Schneider Electric EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert) · CVSS 8.6 High · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num](https://agentprime.io/advisories/CVE-2026-86771.md)
  `CVE-2026-86771` · CVE record: grokability snipe-it · CVSS 8.3 High · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch](https://agentprime.io/advisories/CVE-2026-87821.md)
  `CVE-2026-87821` · CVE record: laradashboard laradashboard · CVSS 7.1 High · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79635.md)
  `CVE-2026-79635` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.3 High · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Apache Impala: Secrets Exfiltration via SSRF](https://agentprime.io/advisories/CVE-2026-57866.md)
  `CVE-2026-57866` · CVE record: Apache Software Foundation Apache Impala · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Apache Impala: Avro Schema URL Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-54048.md)
  `CVE-2026-54048` · CVE record: Apache Software Foundation Apache Impala · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [SSRF in Yordam Informatics's Library Automation System](https://agentprime.io/advisories/CVE-2026-19733.md)
  `CVE-2026-19733` · CVE record: Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80123.md)
  `CVE-2026-80123` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 7.3 High · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Tanium addressed a server-side request forgery vulnerability in Enforce.](https://agentprime.io/advisories/CVE-2026-87084.md)
  `CVE-2026-87084` · CVE record: Tanium Enforce · CVSS 7.7 High · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-87595.md)
  `CVE-2026-87595` · CVE record: Google Chrome · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature](https://agentprime.io/advisories/GHSA-8m3c-c648-2xjj.md)
  `GHSA-8m3c-c648-2xjj`, `CVE-2026-92595` · npm `nodemailer`: affected `<9.1.1`, fixed in `9.1.1` · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, Server-side request forgery (SSRF)
- [vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor \`\_fetch_image\` and audio loader bypass MediaConnector protections](https://agentprime.io/advisories/GHSA-4hhp-h66f-j5j7.md)
  `GHSA-4hhp-h66f-j5j7`, `CVE-2026-73560`, `PYSEC-2026-3934` · PyPI `vllm`: affected `<0.26.0`, fixed in `0.26.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [opengeos GeoLibre \_is_within_roots server-side request forgery](https://agentprime.io/advisories/CVE-2026-86806.md)
  `CVE-2026-86806` · CVE record: opengeos GeoLibre · CVSS 6.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Skype for Business Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-66304.md)
  `CVE-2026-66304` · CVE record: Microsoft Skype for Business Server 2015 CU13 and 2 more · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher](https://agentprime.io/advisories/GHSA-p2w3-6x73-2f6x.md)
  `GHSA-p2w3-6x73-2f6x`, `CVE-2026-73087`, `GO-2026-6440` · Go `github.com/amir20/dozzle`: affected `<1.29.1-0.20260804193351-8cf7ccd5ee04`, fixed in `1.29.1-0.20260804193351-8cf7ccd5ee04` · CVSS 2.3 Low · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning](https://agentprime.io/advisories/CVE-2026-48707.md)
  `CVE-2026-48707` · CVE record: instantsoft icms2 · CVSS 3.1 Low · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Office SharePoint Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-69904.md)
  `CVE-2026-69904` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 3.5 Low · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-81357.md)
  `CVE-2026-81357` · CVE record: Microsoft Visual Studio Code · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Office SharePoint Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-69683.md)
  `CVE-2026-69683` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Exchange Server Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-69361.md)
  `CVE-2026-69361` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [NLTK: pathsec SSRF protection can be bypassed when a proxy is configured](https://agentprime.io/advisories/GHSA-6ww7-3frv-cqxh.md)
  `GHSA-6ww7-3frv-cqxh`, `CVE-2026-78682`, `PYSEC-2026-3733` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 8.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-441
- [snipe-it before 8.7.0 SSRF via IPv6 transition address bypass](https://agentprime.io/advisories/CVE-2026-86735.md)
  `CVE-2026-86735` · CVE record: grokability snipe-it · CVSS 5.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler](https://agentprime.io/advisories/CVE-2026-73315.md)
  `CVE-2026-73315` · CVE record: XenForo XenForo · CVSS 7.7 High · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in Eclipse Foundation Eclipse Che](https://agentprime.io/advisories/CVE-2026-86590.md)
  `CVE-2026-86590` · CVE record: Eclipse Foundation Eclipse Che · CVSS 6.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-81806.md)
  `CVE-2026-81806` · CVE record: John Darrel Hide My WP Ghost · CVSS 7.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence](https://agentprime.io/advisories/CVE-2026-76971.md)
  `CVE-2026-76971` · CVE record: SAP_SE SAP Manufacturing Integration and Intelligence · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint](https://agentprime.io/advisories/CVE-2026-86539.md)
  `CVE-2026-86539` · CVE record: knowns-dev knowns · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF](https://agentprime.io/advisories/GHSA-wprp-8gvj-p6cv.md)
  `GHSA-wprp-8gvj-p6cv`, `CVE-2026-82757`, `EEF-CVE-2026-82757` · Hex `ash_authentication_oauth2_server`: affected `>=0.3.0, <0.3.1`, fixed in `0.3.1` · CVSS 6.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-86503.md)
  `CVE-2026-86503` · CVE record: JetBrains IntelliJ IDEA · CVSS 3.3 Low · Not analysed yet · Published 7 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [java-json-tools jackson-coreutils URL Validation JsonLoader.java JsonLoader.fromURL server-side request forgery](https://agentprime.io/advisories/CVE-2026-86321.md)
  `CVE-2026-86321` · CVE record: java-json-tools jackson-coreutils · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery](https://agentprime.io/advisories/CVE-2026-86419.md)
  `CVE-2026-86419` · CVE record: MISP MISP · CVSS 7.0 High · Not analysed yet · Published 7 Sept 2026 · Tags: Information disclosure, Server-side request forgery (SSRF)
- [projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery](https://agentprime.io/advisories/CVE-2026-86273.md)
  `CVE-2026-86273` · CVE record: projeto-siga siga · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery](https://agentprime.io/advisories/CVE-2026-86240.md)
  `CVE-2026-86240` · CVE record: liufee FeehiCMS · CVSS 5.1 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [openagents-org openagents http.py test_default_model server-side request forgery](https://agentprime.io/advisories/CVE-2026-86237.md)
  `CVE-2026-86237` · CVE record: openagents-org openagents · CVSS 6.9 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation](https://agentprime.io/advisories/CVE-2026-86259.md)
  `CVE-2026-86259` · CVE record: THU-MAIC OpenMAIC · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF)
- [MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler](https://agentprime.io/advisories/CVE-2026-86173.md)
  `CVE-2026-86173` · CVE record: mindsdb mindsdb · CVSS 8.7 High · Not analysed yet · Published 5 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints](https://agentprime.io/advisories/CVE-2026-86123.md)
  `CVE-2026-86123` · CVE record: sqlchat sqlchat · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server](https://agentprime.io/advisories/CVE-2026-86122.md)
  `CVE-2026-86122` · CVE record: rowboatlabs rowboat · CVSS 5.3 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Webstudio through 0.296.0 SSRF via /cgi proxy routes](https://agentprime.io/advisories/CVE-2026-86119.md)
  `CVE-2026-86119` · CVE record: webstudio-is webstudio · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter](https://agentprime.io/advisories/CVE-2026-4361.md)
  `CVE-2026-4361` · CVE record: Elegant Themes Divi · CVSS 5.0 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint](https://agentprime.io/advisories/CVE-2026-83543.md)
  `CVE-2026-83543` · CVE record: Unknown Greenshift · CVSS 4.1 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL](https://agentprime.io/advisories/CVE-2026-86100.md)
  `CVE-2026-86100` · CVE record: owen2345 CamaleonCMS · CVSS 5.3 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI2LTA5LTA0VDIzOjE2OjIzLjIyMzAwMFoiLCJDVkUtMjAyNi04NjEwMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI2LTA5LTEwVDIxOjQxOjM3LjU1NzAwMFoiLCJDVkUtMjAyNi03OTcyMyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI2LTA5LTEwVDIxOjQxOjM3LjU1NzAwMFoiLCJDVkUtMjAyNi03OTcyMyJd>. Everything for agents: <https://agentprime.io/llms.txt>.