# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes](https://agentprime.io/advisories/CVE-2026-100858.md)
  `CVE-2026-100858` · CVE record: heymrun heym · CVSS 7.6 High · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist](https://agentprime.io/advisories/CVE-2026-100850.md)
  `CVE-2026-100850` · CVE record: AzuraCast AzuraCast · CVSS 4.8 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs](https://agentprime.io/advisories/CVE-2026-100849.md)
  `CVE-2026-100849` · CVE record: AzuraCast AzuraCast · CVSS 7.1 High · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL](https://agentprime.io/advisories/CVE-2026-100848.md)
  `CVE-2026-100848` · CVE record: AzuraCast AzuraCast · CVSS 7.1 High · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Kyverno before 1.19.1 SSRF via legacy apiCall service executor](https://agentprime.io/advisories/CVE-2026-100705.md)
  `CVE-2026-100705` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex](https://agentprime.io/advisories/CVE-2026-100698.md)
  `CVE-2026-100698` · CVE record: vrana adminer · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver](https://agentprime.io/advisories/CVE-2026-100697.md)
  `CVE-2026-100697` · CVE record: vrana adminer · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver](https://agentprime.io/advisories/CVE-2026-100696.md)
  `CVE-2026-100696` · CVE record: vrana adminer · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook](https://agentprime.io/advisories/CVE-2026-100681.md)
  `CVE-2026-100681` · CVE record: budibase server · CVSS 6.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [ClawHub SSRF via Unchecked DNS Resolution in Profile Image](https://agentprime.io/advisories/CVE-2026-100601.md)
  `CVE-2026-100601` · CVE record: openclaw clawhub · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL](https://agentprime.io/advisories/CVE-2026-96533.md)
  `CVE-2026-96533` · CVE record: Unknown Testimonials Widget · CVSS 5.8 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset](https://agentprime.io/advisories/CVE-2026-100577.md)
  `CVE-2026-100577` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates](https://agentprime.io/advisories/CVE-2026-100576.md)
  `CVE-2026-100576` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS](https://agentprime.io/advisories/CVE-2026-100574.md)
  `CVE-2026-100574` · CVE record: OpenClaw OpenClaw · CVSS 8.2 High · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname](https://agentprime.io/advisories/CVE-2026-100567.md)
  `CVE-2026-100567` · CVE record: OpenClaw OpenClaw · CVSS 8.9 High · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery](https://agentprime.io/advisories/CVE-2026-100555.md)
  `CVE-2026-100555` · CVE record: OpenClaw OpenClaw · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation](https://agentprime.io/advisories/CVE-2026-100391.md)
  `CVE-2026-100391` · CVE record: mhdzumair mediaflow-proxy · CVSS 8.8 High · Not analysed yet · Published 25 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass](https://agentprime.io/advisories/CVE-2026-100373.md)
  `CVE-2026-100373` · CVE record: open-metadata OpenMetadata · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Zammad: Avatar Image URL Server-Side Request Forwarding](https://agentprime.io/advisories/CVE-2026-56734.md)
  `CVE-2026-56734` · CVE record: zammad zammad · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter](https://agentprime.io/advisories/CVE-2026-12037.md)
  `CVE-2026-12037` · CVE record: gabelivan Asset CleanUp: Page Speed Booster · CVSS 5.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation](https://agentprime.io/advisories/CVE-2026-78397.md)
  `CVE-2026-78397` · CVE record: Unknown Link Library · CVSS 4.0 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [An issue in the VMware datastore driver of OpenStack glance_store.](https://agentprime.io/advisories/CVE-2026-51773.md)
  `CVE-2026-51773` · CVE record · CVSS 8.1 High · Not analysed yet · Published 25 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance.](https://agentprime.io/advisories/CVE-2026-51772.md)
  `CVE-2026-51772` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module](https://agentprime.io/advisories/GHSA-87mg-5grr-rhwh.md)
  `GHSA-87mg-5grr-rhwh`, `CVE-2026-57232`, `PKSA-55tn-sgd6-9twh`, `PKSA-yx24-z15d-x2k7` · Packagist `contao/contao` and 1 more: affected `>=5.3.35, <5.3.48 || >=5.4.0, <5.7.9`, fixed in `5.3.48`, `5.7.9` · CVSS 3.1 Low · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [songxinjianqwe Chat chat-server ChatServer.java server-side request forgery](https://agentprime.io/advisories/CVE-2026-97326.md)
  `CVE-2026-97326` · CVE record: songxinjianqwe Chat · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery](https://agentprime.io/advisories/CVE-2026-97320.md)
  `CVE-2026-97320` · CVE record: YunaiV ruoyi-vue-pro and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)](https://agentprime.io/advisories/CVE-2026-85738.md)
  `CVE-2026-85738` · CVE record: liketrek TREK · CVSS 6.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [TREK: Server-Side Request Forgery via User-Configurable LLM Base URL](https://agentprime.io/advisories/CVE-2026-77294.md)
  `CVE-2026-77294` · CVE record: mauriceboe TREK · CVSS 8.1 High · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Termix: Authenticated SSRF via \`/homepage/proxy\` — No Destination Allowlist](https://agentprime.io/advisories/CVE-2026-79764.md)
  `CVE-2026-79764` · CVE record: Termix-SSH Termix · CVSS 7.7 High · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Termix: Authenticated blind SSRF through notification channel test endpoints](https://agentprime.io/advisories/CVE-2026-79760.md)
  `CVE-2026-79760` · CVE record: Termix-SSH Termix · CVSS 6.4 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass](https://agentprime.io/advisories/CVE-2026-77581.md)
  `CVE-2026-77581` · CVE record: alam00000 bentopdf · CVSS 8.6 High · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint](https://agentprime.io/advisories/CVE-2026-56739.md)
  `CVE-2026-56739` · CVE record: logto-io logto · CVSS 8.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-81549.md)
  `CVE-2026-81549` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter](https://agentprime.io/advisories/CVE-2026-18335.md)
  `CVE-2026-18335` · CVE record: themeum Kirki – Freeform Page Builder, Website Builder & Customizer · CVSS 5.4 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions](https://agentprime.io/advisories/CVE-2026-51997.md)
  `CVE-2026-51997` · CVE record · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: Code injection, Server-side request forgery (SSRF), CWE-20
- [mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header](https://agentprime.io/advisories/CVE-2026-51994.md)
  `CVE-2026-51994` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)](https://agentprime.io/advisories/CVE-2026-84721.md)
  `CVE-2026-84721` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.7 and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials](https://agentprime.io/advisories/GHSA-v3f3-cmj4-cvj9.md)
  `GHSA-v3f3-cmj4-cvj9`, `CVE-2026-76086`, `PKSA-mwqg-ntj6-7bx8` · Packagist `verbb/formie`: affected `<2.2.23 || >=3.0.0, <3.1.31`, fixed in `2.2.23`, `3.1.31` · CVSS 8.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control, Server-side request forgery (SSRF)
- [9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding](https://agentprime.io/advisories/GHSA-6mwv-4mrm-5p3m.md)
  `GHSA-6mwv-4mrm-5p3m`, `CVE-2026-56678` · npm `9router`: affected `<0.5.6`, fixed in `0.5.6` · CVSS 6.4 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-20
- [9router: Image prefetch DNS rebinding allows SSRF to internal services](https://agentprime.io/advisories/GHSA-cmhj-wh2f-9cgx.md)
  `GHSA-cmhj-wh2f-9cgx`, `CVE-2026-56676` · npm `9router`: affected `<0.5.2`, fixed in `0.5.2` · CVSS 7.4 High · Not analysed yet · Published 23 Sept 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [Plex Media Server arbitrary-host SSRF](https://agentprime.io/advisories/CVE-2026-96655.md)
  `CVE-2026-96655` · CVE record: Plex Media Server · CVSS 5.3 Medium · Critical (KEV) · In CISA KEV · EPSS 0.11 · Not analysed yet · Published 23 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Plex Media Server SSRF](https://agentprime.io/advisories/CVE-2026-96652.md)
  `CVE-2026-96652` · CVE record: Plex Media Server · CVSS 5.3 Medium · Critical (KEV) · In CISA KEV · EPSS 0.12 · Not analysed yet · Published 23 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [SSRF Leading to JWT Token Disclosure in Global IT Informatics' Weoll](https://agentprime.io/advisories/CVE-2026-77112.md)
  `CVE-2026-77112` · CVE record: Global IT Informatics Technology Services Inc. Weoll · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL](https://agentprime.io/advisories/CVE-2026-84046.md)
  `CVE-2026-84046` · CVE record: Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads · CVSS 5.0 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery](https://agentprime.io/advisories/CVE-2026-95930.md)
  `CVE-2026-95930` · CVE record: iFlytek astron-agent · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18066.md)
  `CVE-2026-18066` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 7.9 High · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-16426.md)
  `CVE-2026-16426` · CVE record: IBM Concert · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery](https://agentprime.io/advisories/CVE-2026-77987.md)
  `CVE-2026-77987` · CVE record: GitHub Enterprise Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-208
- [Home Assistant: mDNS Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-4ghv-53cq-7wp3.md)
  `GHSA-4ghv-53cq-7wp3`, `CVE-2026-91129`, `PYSEC-2026-4051` · PyPI `homeassistant`: affected `<2026.2.3`, fixed in `2026.2.3` · CVSS 5.4 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses](https://agentprime.io/advisories/GHSA-jvh5-97xg-v99f.md)
  `GHSA-jvh5-97xg-v99f`, `CVE-2026-79913`, `GO-2026-6572` · Go `github.com/cloudreve/Cloudreve/v4`: affected `<4.0.0-20260715072853-1c5cad6dec7e`, fixed in `4.0.0-20260715072853-1c5cad6dec7e` · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-697
- [lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard](https://agentprime.io/advisories/GHSA-vv3m-f8x4-7377.md)
  `GHSA-vv3m-f8x4-7377`, `CVE-2026-85740`, `PYSEC-2026-4064` · PyPI `lightrag-hku`: affected `<1.5.5`, fixed in `1.5.5` · CVSS 7.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup](https://agentprime.io/advisories/GHSA-v9m3-wfh8-5646.md)
  `GHSA-v9m3-wfh8-5646`, `CVE-2026-77249`, `PYSEC-2026-4100` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [MCP Atlassian: SSRF Protection Bypass](https://agentprime.io/advisories/GHSA-hgcf-4mq8-5266.md)
  `GHSA-hgcf-4mq8-5266`, `CVE-2026-77274`, `PYSEC-2026-4096` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [mcp-atlassian has an incomplete SSRF remediation](https://agentprime.io/advisories/GHSA-5wf4-jqxh-8gm3.md)
  `GHSA-5wf4-jqxh-8gm3`, `CVE-2026-77267`, `PYSEC-2026-4084` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 8.3 High · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches](https://agentprime.io/advisories/GHSA-6529-c226-h328.md)
  `GHSA-6529-c226-h328`, `CVE-2026-77261`, `PYSEC-2026-4085` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 7.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow](https://agentprime.io/advisories/GHSA-49xv-9743-pw8w.md)
  `GHSA-49xv-9743-pw8w`, `CVE-2026-77265`, `PYSEC-2026-4083` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 5.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator](https://agentprime.io/advisories/CVE-2026-96259.md)
  `CVE-2026-96259` · CVE record: Mattermost Mattermost · CVSS 5.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler](https://agentprime.io/advisories/GHSA-fjwv-jf2v-j499.md)
  `GHSA-fjwv-jf2v-j499`, `CVE-2026-61681`, `GO-2026-6565` · Go `github.com/hatchet-dev/hatchet`: affected `<0.91.1`, fixed in `0.91.1` · CVSS 4.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [OpenCVE: Server-Side Request Forgery (SSRF) in notifications](https://agentprime.io/advisories/GHSA-ch3g-4xvr-674q.md)
  `GHSA-ch3g-4xvr-674q`, `CVE-2026-62282`, `PYSEC-2026-4130` · PyPI `opencve`: affected `<3.0.0`, fixed in `3.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Premiere Pro | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-84395.md)
  `CVE-2026-84395` · CVE record: Adobe Premiere · CVSS 7.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI2LTA5LTIyVDE4OjU4OjEyLjg2MDAwMFoiLCJDVkUtMjAyNi04NDM5NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI2LTA5LTI3VDAxOjI4OjQ5Ljg4MDAwMFoiLCJDVkUtMjAyNi0xMDA4NTkiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI2LTA5LTI3VDAxOjI4OjQ5Ljg4MDAwMFoiLCJDVkUtMjAyNi0xMDA4NTkiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.