# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Arbitrary File Read and SSRF in Google AppSheet](https://agentprime.io/advisories/CVE-2026-2274.md)
  `CVE-2026-2274` · CVE record: AppSheet AppSheet Web (Main Server) · CVSS 8.5 High · Not analysed yet · Published 19 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-25428.md)
  `CVE-2026-25428` · CVE record: totalsoft TS Poll · CVSS 4.4 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-25385.md)
  `CVE-2026-25385` · CVE record: KaizenCoders URL Shortify · CVSS 5.5 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-25310.md)
  `CVE-2026-25310` · CVE record: Alobaidi Extend Link · CVSS 4.9 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress Smart Auto Upload Images plugin <= 1.2.2 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-23803.md)
  `CVE-2026-23803` · CVE record: Burhan Nasir Smart Auto Upload Images · CVSS 7.2 High · Not analysed yet · Published 19 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [zhutoutoutousan worldquant-miner URL ssrf_proxy.py server-side request forgery](https://agentprime.io/advisories/CVE-2026-2711.md)
  `CVE-2026-2711` · CVE record: zhutoutoutousan worldquant-miner · CVSS 6.3 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Printful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2025-12375.md)
  `CVE-2025-12375` · CVE record: printful Printful Integration for WooCommerce · CVSS 6.4 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery (SSRF).](https://agentprime.io/advisories/CVE-2025-55853.md)
  `CVE-2025-55853` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension](https://agentprime.io/advisories/GHSA-x22m-j5qq-j49m.md)
  `GHSA-x22m-j5qq-j49m`, `CVE-2026-28451` · npm `openclaw`: affected `<2026.2.14`, fixed in `2026.2.14` · CVSS 6.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Hugging Face Smolagents has a Server-Side Request Forgery issue](https://agentprime.io/advisories/GHSA-jxgv-6j54-wwc7.md)
  `GHSA-jxgv-6j54-wwc7`, `CVE-2026-2654`, `PYSEC-2026-3067` · PyPI `smolagents`: affected `<=1.24.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter](https://agentprime.io/advisories/CVE-2026-1857.md)
  `CVE-2026-1857` · CVE record: stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor · CVSS 4.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Withdrawn Advisory: Libredesk has a SSRF Vulnerability in Webhooks](https://agentprime.io/advisories/GHSA-wgm6-9rvv-3438.md)
  `GHSA-wgm6-9rvv-3438`, `CVE-2026-26957`, `GO-2026-4505` · Go `github.com/abhinavxd/libredesk`: affected `<1.0.2-0.20260215211005-727213631ce6`, fixed in `1.0.2-0.20260215211005-727213631ce6` · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 18 Feb 2026 · Tags: Information disclosure, Server-side request forgery (SSRF)
- [OpenClaw affected by SSRF in optional Tlon (Urbit) extension authentication](https://agentprime.io/advisories/GHSA-pg2v-8xwh-qhcc.md)
  `GHSA-pg2v-8xwh-qhcc`, `CVE-2026-28476` · npm `openclaw`: affected `<2026.2.14`, fixed in `2026.2.14` · CVSS 6.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in NETAPP StorageGRID (formerly StorageGRID Webscale)](https://agentprime.io/advisories/CVE-2026-22048.md)
  `CVE-2026-22048` · CVE record: NETAPP StorageGRID (formerly StorageGRID Webscale) · CVSS 7.1 High · Not analysed yet · Published 17 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)](https://agentprime.io/advisories/GHSA-jrvc-8ff5-2f9f.md)
  `GHSA-jrvc-8ff5-2f9f`, `CVE-2026-26324` · npm `openclaw`: affected `<2026.2.14`, fixed in `2026.2.14` · CVSS 7.5 High · Not analysed yet · Published 17 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw Gateway tool allowed unrestricted gatewayUrl override](https://agentprime.io/advisories/GHSA-g6q9-8fvw-f7rf.md)
  `GHSA-g6q9-8fvw-f7rf`, `CVE-2026-26322` · npm `openclaw`: affected `<2026.2.14`, fixed in `2026.2.14` · CVSS 7.6 High · Not analysed yet · Published 17 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [OpenClaw affected by SSRF via attachment/media URL hydration](https://agentprime.io/advisories/GHSA-wfp2-v9c7-fh79.md)
  `GHSA-wfp2-v9c7-fh79`, `CVE-2026-28467` · npm `openclaw`: affected `<2026.2.2`, fixed in `2026.2.2` · CVSS 6.3 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Multiple Vulnerabilities in IBM Concert Software.](https://agentprime.io/advisories/CVE-2025-36243.md)
  `CVE-2025-36243` · CVE record: IBM Concert · CVSS 5.4 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Indico has Server-Side Request Forgery (SSRF) in multiple places](https://agentprime.io/advisories/GHSA-f47c-3c5w-v7p4.md)
  `GHSA-f47c-3c5w-v7p4`, `CVE-2026-25738`, `PYSEC-2026-2181` · PyPI `indico`: affected `<3.3.10`, fixed in `3.3.10` · CVSS 6.9 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [OpenClaw affected by SSRF in Image Tool Remote Fetch](https://agentprime.io/advisories/GHSA-56f2-hvwg-5743.md)
  `GHSA-56f2-hvwg-5743` · npm `openclaw`: affected `<2026.2.2`, fixed in `2026.2.2` · CVSS 7.6 High · Not analysed yet · Published 17 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections.](https://agentprime.io/advisories/CVE-2025-32355.md)
  `CVE-2025-32355` · CVE record · CVSS 7.9 High · Not analysed yet · Published 17 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [GeekAI net_handler.go Download server-side request forgery](https://agentprime.io/advisories/CVE-2026-2558.md)
  `CVE-2026-2558` · CVE record: GeekAI · CVSS 5.3 Medium · Not analysed yet · Published 16 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [cskefu Endpoint MediaController.java server-side request forgery](https://agentprime.io/advisories/CVE-2026-2556.md)
  `CVE-2026-2556` · CVE record: cskefu · CVSS 5.3 Medium · Not analysed yet · Published 16 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. S...](https://agentprime.io/advisories/GHSA-6xw9-2p64-7622.md)
  `GHSA-6xw9-2p64-7622`, `CVE-2026-2531`, `PYSEC-2026-91` · PyPI `mindsdb`: affected `<26.0.0rc1`, fixed in `26.0.0rc1` · CVSS 5.3 Medium · Not analysed yet · Published 16 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [lintsinghua DeepAudit IP Address embedding_config.py server-side request forgery](https://agentprime.io/advisories/CVE-2026-2532.md)
  `CVE-2026-2532` · CVE record: lintsinghua DeepAudit · CVSS 5.3 Medium · Not analysed yet · Published 16 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-1249.md)
  `CVE-2026-1249` · CVE record: sonaar MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar · CVSS 5.0 Medium · Not analysed yet · Published 14 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter](https://agentprime.io/advisories/CVE-2026-0745.md)
  `CVE-2026-0745` · CVE record: webilop User Language Switch · CVSS 5.5 Medium · Not analysed yet · Published 14 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import](https://agentprime.io/advisories/CVE-2026-25991.md)
  `CVE-2026-25991` · CVE record: TandoorRecipes recipes · CVSS 7.7 High · Not analysed yet · Published 13 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [ClipBucket v5 enables internal network scans via an SSRF vulnerability](https://agentprime.io/advisories/CVE-2026-26005.md)
  `CVE-2026-26005` · CVE record: MacWarrior clipbucket-v5 · CVSS 5.0 Medium · Not analysed yet · Published 12 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src](https://agentprime.io/advisories/CVE-2026-1356.md)
  `CVE-2026-1356` · CVE record: mateuszgbiorczyk Converter for Media – Optimize images | Convert WebP & AVIF · CVSS 4.8 Medium · Not analysed yet · Published 12 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation](https://agentprime.io/advisories/GHSA-gf3v-fwqg-4vh7.md)
  `GHSA-gf3v-fwqg-4vh7`, `CVE-2026-26019` · npm `@langchain/community`: affected `<1.1.14`, fixed in `1.1.14` · CVSS 4.1 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages](https://agentprime.io/advisories/GHSA-2g6r-c272-w58r.md)
  `GHSA-2g6r-c272-w58r`, `CVE-2026-26013`, `PYSEC-2026-2562` · PyPI `langchain-core`: affected `<1.2.11`, fixed in `1.2.11` · CVSS 3.7 Low · Not analysed yet · Published 11 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery (SSRF) in GitLab](https://agentprime.io/advisories/CVE-2025-12073.md)
  `CVE-2025-12073` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery (SSRF) in GitLab](https://agentprime.io/advisories/CVE-2025-12575.md)
  `CVE-2025-12575` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [DoraCMS <= 3.1 UEditor Remote Image Fetch SSRF](https://agentprime.io/advisories/CVE-2026-25870.md)
  `CVE-2026-25870` · CVE record: doramart DoraCMS · CVSS 6.9 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Azure DevOps Server Cross-Site Scripting Vulnerability](https://agentprime.io/advisories/CVE-2026-21512.md)
  `CVE-2026-21512` · CVE record: Microsoft Azure DevOps Server 2022 · CVSS 6.5 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [SSRF in Teknolist Computer's Okulistik](https://agentprime.io/advisories/CVE-2025-11242.md)
  `CVE-2025-11242` · CVE record: Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url](https://agentprime.io/advisories/GHSA-33mh-2634-fwr2.md)
  `GHSA-33mh-2634-fwr2`, `CVE-2026-25765` · RubyGems `faraday`: affected `>=1.0.0, <1.10.5 || >=2.0.0, <2.14.1`, fixed in `1.10.5`, `2.14.1` · CVSS 5.8 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection](https://agentprime.io/advisories/GHSA-v34v-rq6j-cj6p.md)
  `GHSA-v34v-rq6j-cj6p`, `CVE-2026-25528`, `PYSEC-2026-2584` · npm `langsmith` and 1 more: affected `>=0.3.41, <0.4.6`, fixed in `0.4.6` · CVSS 5.8 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation](https://agentprime.io/advisories/GHSA-m5r2-8p9x-hp5m.md)
  `GHSA-m5r2-8p9x-hp5m`, `CVE-2026-25494`, `PKSA-jsy4-k6z3-fcjb` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.16.18 || >=5.0.0-RC1, <5.8.22`, fixed in `4.16.18`, `5.8.22` · CVSS 6.9 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect](https://agentprime.io/advisories/GHSA-8jr8-7hr4-vhfx.md)
  `GHSA-8jr8-7hr4-vhfx`, `CVE-2026-25493`, `PKSA-1dbt-xzgs-7gw8` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.16.18 || >=5.0.0-RC1, <5.8.22`, fixed in `4.16.18`, `5.8.22` · CVSS 6.9 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host](https://agentprime.io/advisories/GHSA-96pq-hxpw-rgh8.md)
  `GHSA-96pq-hxpw-rgh8`, `CVE-2026-25492`, `PKSA-jd1d-xg2h-yr6f` · Packagist `craftcms/craft`: affected `>=3.5.0, <4.16.18 || >=5.0.0-RC1, <5.8.22`, fixed in `4.16.18`, `5.8.22` · CVSS 5.3 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'](https://agentprime.io/advisories/CVE-2026-0632.md)
  `CVE-2026-0632` · CVE record: techjewel Fluent Forms Pro Add On Pack · CVSS 5.4 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access](https://agentprime.io/advisories/GHSA-6fgp-m6q4-j3q5.md)
  `GHSA-6fgp-m6q4-j3q5`, `CVE-2026-25904`, `PYSEC-2026-2627` · PyPI `mcp-run-python`: affected `<=0.0.22`, no fixed version yet · CVSS 5.8 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping](https://agentprime.io/advisories/CVE-2026-25123.md)
  `CVE-2026-25123` · CVE record: homarr-labs homarr · CVSS 5.3 Medium · Not analysed yet · Published 6 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling](https://agentprime.io/advisories/GHSA-2jrp-274c-jhv3.md)
  `GHSA-2jrp-274c-jhv3`, `CVE-2026-25580`, `PYSEC-2026-2976`, `PYSEC-2026-2980` · PyPI `pydantic-ai` and 1 more: affected `>=0.0.26, <1.56.0`, fixed in `1.56.0` · CVSS 8.6 High · Not analysed yet · Published 6 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior](https://agentprime.io/advisories/GHSA-8fgc-7cc6-rx7x.md)
  `GHSA-8fgc-7cc6-rx7x`, `CVE-2025-68458` · npm `webpack`: affected `>=5.49.0, <5.104.1`, fixed in `5.104.1` · CVSS 3.7 Low · Not analysed yet · Published 5 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence](https://agentprime.io/advisories/GHSA-38r7-794h-5758.md)
  `GHSA-38r7-794h-5758`, `CVE-2025-68157` · npm `webpack`: affected `>=5.49.0, <5.104.0`, fixed in `5.104.0` · CVSS 3.7 Low · Not analysed yet · Published 5 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint](https://agentprime.io/advisories/CVE-2026-1294.md)
  `CVE-2026-1294` · CVE record: bplugins All In One Image Viewer Block – Gutenberg block to create image viewer with hyperlink · CVSS 7.2 High · Not analysed yet · Published 5 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [AutoGPT has SSRF vulnerability in SendDiscordFileBlock](https://agentprime.io/advisories/CVE-2025-62616.md)
  `CVE-2025-62616` · CVE record: Significant-Gravitas AutoGPT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [AutoGPT has SSRF vulnerability in ReadRSSFeedBlock](https://agentprime.io/advisories/CVE-2025-62615.md)
  `CVE-2025-62615` · CVE record: Significant-Gravitas AutoGPT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [ZenTao Webhook model.php fetchHook server-side request forgery](https://agentprime.io/advisories/CVE-2026-1884.md)
  `CVE-2026-1884` · CVE record: ZenTao · CVSS 5.1 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Group-Office is vulnerable to SSRF and File Read in WOPI service discovery](https://agentprime.io/advisories/CVE-2026-25511.md)
  `CVE-2026-25511` · CVE record: Intermesh groupoffice · CVSS 8.2 High · Not analysed yet · Published 4 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [GLPI is Vulnerable to SSRF via Webhooks](https://agentprime.io/advisories/CVE-2026-22247.md)
  `CVE-2026-22247` · CVE record: glpi-project glpi · CVSS 4.1 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API in github.com/axllent/mailpit](https://agentprime.io/advisories/GHSA-6jxm-fv7w-rw5j.md)
  `GHSA-6jxm-fv7w-rw5j`, `CVE-2026-23845`, `GO-2026-4345` · Go `github.com/axllent/mailpit`: affected `<1.28.3`, fixed in `1.28.3` · CVSS 5.8 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress Grand Blog theme < 3.1.5 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-24961.md)
  `CVE-2026-24961` · CVE record: ThemeGoods Grand Blog · CVSS 5.4 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature.](https://agentprime.io/advisories/CVE-2025-46651.md)
  `CVE-2025-46651` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper](https://agentprime.io/advisories/GHSA-mxxc-p822-2hx9.md)
  `GHSA-mxxc-p822-2hx9`, `CVE-2026-24470`, `GO-2026-4378` · Go `github.com/zalando/skipper`: affected `<0.24.0`, fixed in `0.24.0` · CVSS 8.1 High · Not analysed yet · Published 2 Feb 2026 · Tags: Server-side request forgery (SSRF), CWE-441
- [XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -](https://agentprime.io/advisories/CVE-2025-13096.md)
  `CVE-2025-13096` · CVE record: IBM Business Automation Workflow containers and 1 more · CVSS 7.1 High · Not analysed yet · Published 2 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Keycloak Server-Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/GHSA-fwhw-chw4-gh37.md)
  `GHSA-fwhw-chw4-gh37`, `CVE-2026-1518` · Maven `org.keycloak:keycloak-parent`: affected `<=26.5.2`, no fixed version yet · CVSS 2.7 Low · Not analysed yet · Published 2 Feb 2026 · Tags: Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI2LTAyLTAyVDA5OjMwOjMwLjAwMDAwMFoiLCJHSFNBLWZ3aHctY2h3NC1naDM3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI2LTAyLTE5VDE3OjAzOjIzLjUyMTAwMFoiLCJDVkUtMjAyNi0yNjMzOCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI2LTAyLTE5VDE3OjAzOjIzLjUyMTAwMFoiLCJDVkUtMjAyNi0yNjMzOCJd>. Everything for agents: <https://agentprime.io/llms.txt>.