# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak](https://agentprime.io/advisories/CVE-2026-4366.md)
  `CVE-2026-4366` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.8 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy](https://agentprime.io/advisories/GHSA-9x67-f2v7-63rw.md)
  `GHSA-9x67-f2v7-63rw`, `CVE-2026-33039`, `PKSA-spwc-tcr7-cpby` · Packagist `wwbn/avideo`: affected `<=25.0`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 17 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery](https://agentprime.io/advisories/CVE-2026-4308.md)
  `CVE-2026-4308` · CVE record: frdel agent-zero and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [taoofagi easegen-admin PPT File PPTUtil.java downloadFile server-side request forgery](https://agentprime.io/advisories/CVE-2026-4284.md)
  `CVE-2026-4284` · CVE record: taoofagi easegen-admin · CVSS 5.1 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint](https://agentprime.io/advisories/GHSA-6j68-gcc3-mq73.md)
  `GHSA-6j68-gcc3-mq73`, `CVE-2026-32812`, `PKSA-k5pv-h718-ynrx` · Packagist `admidio/admidio`: affected `>=5.0.0, <5.0.7`, fixed in `5.0.7` · CVSS 6.8 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration](https://agentprime.io/advisories/GHSA-j94x-8wcp-x7hm.md)
  `GHSA-j94x-8wcp-x7hm`, `CVE-2026-32828`, `GO-2026-4717` · Go `github.com/akuity/kargo`: affected `>=1.4.0, <1.6.4 || >=1.7.0-rc.1, <1.7.9 || >=1.8.0-rc.1, <1.8.12 || >=1.9.0-rc.1, <1.9.5`, fixed in `1.6.4`, `1.7.9`, `1.8.12`, `1.9.5` · CVSS 5.1 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation](https://agentprime.io/advisories/GHSA-gqv7-j2j8-qmwq.md)
  `GHSA-gqv7-j2j8-qmwq`, `CVE-2026-2455`, `GO-2026-4746` · Go `github.com/mattermost/mattermost-server` and 1 more: affected `<5.3.2-0.20260129133647-5d787969c2d5 || >=10.11.0-rc1, <10.11.11 || >=11.2.0-rc1, <11.2.3 || >=11.3.0-rc1, <11.3.1`, fixed in `5.3.2-0.20260129133647-5d787969c2d5`, `10.11.11`, `11.2.3`, `11.3.1` · CVSS 4.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames](https://agentprime.io/advisories/GHSA-8r8j-gfhg-fw38.md)
  `GHSA-8r8j-gfhg-fw38`, `CVE-2026-25534` · Maven `io.spinnaker.clouddriver:clouddriver-artifacts` and 1 more: affected `>=2025.1.6, <2025.2.4 || >=2025.3.0, <2025.3.1 || >=2025.4.0, <2025.4.1`, fixed in `2025.2.4`, `2025.3.1`, `2025.4.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Site Request Forgery in Raytha CMS](https://agentprime.io/advisories/CVE-2025-69239.md)
  `CVE-2025-69239` · CVE record: Raytha Raytha · CVSS 5.1 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [vanna-ai vanna Endpoint \_\_init\_\_.py run_sql server-side request forgery](https://agentprime.io/advisories/CVE-2026-4231.md)
  `CVE-2026-4231` · CVE record: vanna-ai vanna · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [FlowCI flow-core-x SMTP Host ConfigServiceImpl.java save server-side request forgery](https://agentprime.io/advisories/CVE-2026-4215.md)
  `CVE-2026-4215` · CVE record: FlowCI flow-core-x · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [glowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgery](https://agentprime.io/advisories/CVE-2026-4200.md)
  `CVE-2026-4200` · CVE record: glowxq glowxq-oj · CVSS 6.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL](https://agentprime.io/advisories/GHSA-j77h-rr39-c552.md)
  `GHSA-j77h-rr39-c552`, `CVE-2026-32301`, `GO-2026-4702` · Go `github.com/centrifugal/centrifugo` and 4 more: affected `<=2.4.0`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress Gift Up Gift Cards for WordPress and WooCommerce plugin <= 3.1.7 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-32412.md)
  `CVE-2026-32412` · CVE record: Gift Up! Gift Up Gift Cards for WordPress and WooCommerce · CVSS 5.4 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-32357.md)
  `CVE-2026-32357` · CVE record: Katsushi Kawamori Simple Blog Card · CVSS 6.4 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress MailerPress plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-32353.md)
  `CVE-2026-32353` · CVE record: MailerPress Team MailerPress · CVSS 6.4 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress Embed PDF Viewer plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-32349.md)
  `CVE-2026-32349` · CVE record: Andy Fragen Embed PDF Viewer · CVSS 4.9 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch](https://agentprime.io/advisories/GHSA-qp4c-xg64-7c6x.md)
  `GHSA-qp4c-xg64-7c6x`, `CVE-2026-32236` · npm `@backstage/plugin-auth-backend`: affected `<0.27.1`, fixed in `0.27.1` · CVSS 1.7 Low · Not analysed yet · Published 12 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle](https://agentprime.io/advisories/GHSA-fmfg-9g7c-3vq7.md)
  `GHSA-fmfg-9g7c-3vq7`, `CVE-2026-32111`, `PYSEC-2026-2507` · PyPI `ha-mcp`: affected `<7.0.0`, fixed in `7.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [SiYuan has a Full-Read SSRF via /api/network/forwardProxy](https://agentprime.io/advisories/GHSA-56cv-c5p2-j2wg.md)
  `GHSA-56cv-c5p2-j2wg`, `CVE-2026-32110`, `GO-2026-4685` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<3.6.0`, fixed in `3.6.0` · CVSS 8.3 High · Not analysed yet · Published 12 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [648540858 wvp-GB28181-pro IP Address ABLMediaNodeServerService.java getDownloadFilePath server-side request forgery](https://agentprime.io/advisories/CVE-2026-3966.md)
  `CVE-2026-3966` · CVE record: 648540858 wvp-GB28181-pro · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [zyddnys manga-image-translator Translate Endpoints request_extraction.py to_pil_image server-side request forgery](https://agentprime.io/advisories/CVE-2026-3961.md)
  `CVE-2026-3961` · CVE record: zyddnys manga-image-translator · CVSS 5.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [2FAuth has Blind SSRF in image parameter allows internal network access and more](https://agentprime.io/advisories/CVE-2026-32133.md)
  `CVE-2026-32133` · CVE record: Bubka 2FAuth · CVSS 7.8 High · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Woahai321 ListSync JSON api_server.py requests.post server-side request forgery](https://agentprime.io/advisories/CVE-2026-3958.md)
  `CVE-2026-3958` · CVE record: Woahai321 ListSync · CVSS 5.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns](https://agentprime.io/advisories/CVE-2026-32096.md)
  `CVE-2026-32096` · CVE record: useplunk plunk · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Blind SSRF on OpenProject instance via webhooks](https://agentprime.io/advisories/CVE-2026-31974.md)
  `CVE-2026-31974` · CVE record: opf openproject · CVSS 3.0 Low · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Frappe: Possible SSRF by any authenticated user](https://agentprime.io/advisories/CVE-2026-31878.md)
  `CVE-2026-31878` · CVE record: frappe frappe · CVSS 5.0 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-21293.md)
  `CVE-2026-21293` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-21294.md)
  `CVE-2026-21294` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval](https://agentprime.io/advisories/GHSA-7q3q-5px6-4c5p.md)
  `GHSA-7q3q-5px6-4c5p`, `CVE-2026-31959`, `GO-2026-4671` · Go `github.com/anchore/quill`: affected `<0.7.1`, fixed in `0.7.1` · CVSS 5.3 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF), CWE-20
- [Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access](https://agentprime.io/advisories/GHSA-fvcw-9w9r-pxc7.md)
  `GHSA-fvcw-9w9r-pxc7`, `CVE-2026-31829` · npm `flowise` and 1 more: affected `<3.0.13`, fixed in `3.0.13` · CVSS 7.1 High · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.](https://agentprime.io/advisories/CVE-2025-70027.md)
  `CVE-2025-70027` · CVE record · CVSS 7.5 High · Not analysed yet · Published 11 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [pdfmake is vulnerable to server-side request forgery (SSRF)](https://agentprime.io/advisories/GHSA-wp52-r2fp-4vmr.md)
  `GHSA-wp52-r2fp-4vmr`, `CVE-2026-26801` · npm `pdfmake`: affected `>=0.3.0-beta.2, <0.3.6`, fixed in `0.3.6` · CVSS 7.5 High · Not analysed yet · Published 10 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest](https://agentprime.io/advisories/CVE-2026-30953.md)
  `CVE-2026-30953` · CVE record: Kovah LinkAce · CVSS 7.7 High · Not analysed yet · Published 10 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers](https://agentprime.io/advisories/GHSA-7r34-79r5-rcc9.md)
  `GHSA-7r34-79r5-rcc9`, `CVE-2026-27826`, `PYSEC-2026-2621` · PyPI `mcp-atlassian`: affected `<0.17.0`, fixed in `0.17.0` · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 10 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network](https://agentprime.io/advisories/GHSA-hhfx-wfvq-7g9c.md)
  `GHSA-hhfx-wfvq-7g9c`, `CVE-2026-26118`, `PYSEC-2026-2669` · npm `@azure/mcp` and 2 more: affected `>=1.0.0, <1.0.2 || >=2.0.0-beta.1, <2.0.0-beta.17`, fixed in `1.0.2`, `2.0.0-beta.17` · CVSS 8.8 High · Not analysed yet · Published 10 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [ZITADEL has potential SSRF via Actions in github.com/zitadel/zitadel](https://agentprime.io/advisories/GHSA-7777-fhq9-592v.md)
  `GHSA-7777-fhq9-592v`, `CVE-2026-27945`, `GO-2026-4574` · Go `github.com/zitadel/zitadel`: affected `<1.80.0-v2.20.0.20260225053328-b2532e966621`, fixed in `1.80.0-v2.20.0.20260225053328-b2532e966621` · CVSS 2.1 Low · Not analysed yet · Published 10 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Azure IOT Explorer Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-26121.md)
  `CVE-2026-26121` · CVE record: Microsoft Azure IoT Explorer · CVSS 7.5 High · Not analysed yet · Published 10 Mar 2026 · Tags: Server-side request forgery (SSRF), CWE-20
- [Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP](https://agentprime.io/advisories/CVE-2026-24316.md)
  `CVE-2026-24316` · CVE record: SAP_SE SAP NetWeaver Application Server for ABAP · CVSS 6.4 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [vLLM has SSRF Protection Bypass](https://agentprime.io/advisories/GHSA-v359-jj2v-j536.md)
  `GHSA-v359-jj2v-j536`, `CVE-2026-25960`, `PYSEC-2026-3411` · PyPI `vllm`: affected `>=0.15.1, <0.17.0`, fixed in `0.17.0` · CVSS 7.1 High · Not analysed yet · Published 9 Mar 2026 · Tags: Server-side request forgery (SSRF), CWE-474
- [Server-Side Request Forgery (SSRF) in ikea dirigera](https://agentprime.io/advisories/CVE-2026-3588.md)
  `CVE-2026-3588` · CVE record: ikea dirigera · CVSS 7.5 High · Not analysed yet · Published 9 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master.](https://agentprime.io/advisories/CVE-2025-70042.md)
  `CVE-2025-70042` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Bytedesk SpringAIGiteeRestController SpringAIGiteeRestService.java getModels server-side request forgery](https://agentprime.io/advisories/CVE-2026-3789.md)
  `CVE-2026-3789` · CVE record: Bytedesk · CVSS 5.3 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Bytedesk SpringAIOpenrouterRestController SpringAIOpenrouterRestService.java getModels server-side request forgery](https://agentprime.io/advisories/CVE-2026-3788.md)
  `CVE-2026-3788` · CVE record: Bytedesk · CVSS 5.3 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [ContiNew Admin Storage Management S3ClientFactory.java URI.create server-side request forgery](https://agentprime.io/advisories/CVE-2026-3750.md)
  `CVE-2026-3750` · CVE record: ContiNew Admin · CVSS 5.1 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [xuxueli xxl-job JobInfoController.java server-side request forgery](https://agentprime.io/advisories/CVE-2026-3733.md)
  `CVE-2026-3733` · CVE record: xuxueli xxl-job · CVSS 5.3 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery](https://agentprime.io/advisories/CVE-2026-3683.md)
  `CVE-2026-3683` · CVE record: bufanyun HotGo · CVSS 5.3 Medium · Not analysed yet · Published 7 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [welovemedia FFmate webhook.go fireWebhook server-side request forgery](https://agentprime.io/advisories/CVE-2026-3681.md)
  `CVE-2026-3681` · CVE record: welovemedia FFmate · CVSS 5.3 Medium · Not analysed yet · Published 7 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Homarr: Unauthenticated SSRF in rssFeed.ts](https://agentprime.io/advisories/CVE-2026-27797.md)
  `CVE-2026-27797` · CVE record: homarr-labs homarr · CVSS 5.3 Medium · Not analysed yet · Published 7 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Wallos: Server-Side Request Forgery (SSRF) in Notification Testers](https://agentprime.io/advisories/CVE-2026-30840.md)
  `CVE-2026-30840` · CVE record: ellite Wallos · CVSS 8.8 High · Not analysed yet · Published 7 Mar 2026 · Tags: Weak cryptography or TLS, Server-side request forgery (SSRF)
- [Wallos: SSRF via webhook test endpoint](https://agentprime.io/advisories/CVE-2026-30839.md)
  `CVE-2026-30839` · CVE record: ellite Wallos · CVSS 5.3 Medium · Not analysed yet · Published 7 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Wallos: SSRF via url parameter leading to File Traversal](https://agentprime.io/advisories/CVE-2026-30828.md)
  `CVE-2026-30828` · CVE record: ellite Wallos · CVSS 8.7 High · Not analysed yet · Published 7 Mar 2026 · Tags: Path traversal, Server-side request forgery (SSRF), CWE-29
- [WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources](https://agentprime.io/advisories/GHSA-h6gw-8f77-mmmp.md)
  `GHSA-h6gw-8f77-mmmp`, `CVE-2026-30858`, `GO-2026-4643` · Go `github.com/Tencent/WeKnora`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 6.5 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import](https://agentprime.io/advisories/GHSA-3fvx-xrxq-8jvv.md)
  `GHSA-3fvx-xrxq-8jvv`, `CVE-2026-30832`, `GO-2026-4634` · Go `github.com/charmbracelet/soft-serve`: affected `>=0.6.0, <0.11.4`, fixed in `0.11.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading](https://agentprime.io/advisories/CVE-2026-30844.md)
  `CVE-2026-30844` · CVE record: Wekan Wekan · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [PinchTab has SSRF with Full Response Exfiltration via Download Handler](https://agentprime.io/advisories/GHSA-rw8p-c6hf-q3pg.md)
  `GHSA-rw8p-c6hf-q3pg`, `CVE-2026-30834`, `GO-2026-4631` · Go `github.com/pinchtab/pinchtab/cmd/pinchtab`: affected `<0.7.7`, fixed in `0.7.7` · CVSS 7.5 High · Not analysed yet · Published 6 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Ghostfolio: Full-Read SSRF in Manual Asset Import](https://agentprime.io/advisories/CVE-2026-28680.md)
  `CVE-2026-28680` · CVE record: ghostfolio ghostfolio · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [OpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal access](https://agentprime.io/advisories/CVE-2026-28677.md)
  `CVE-2026-28677` · CVE record: OpenSift OpenSift · CVSS 8.2 High · Not analysed yet · Published 6 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [WeKnora is Vulnerable to SSRF via Redirection](https://agentprime.io/advisories/GHSA-595m-wc8g-6qgc.md)
  `GHSA-595m-wc8g-6qgc`, `CVE-2026-30247`, `GO-2026-4628` · Go `github.com/Tencent/WeKnora`: affected `<0.2.12`, fixed in `0.2.12` · CVSS 5.9 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer](https://agentprime.io/advisories/GHSA-fpx8-73gf-7x73.md)
  `GHSA-fpx8-73gf-7x73`, `CVE-2026-30242` · PyPI `plane`: affected `<1.2.3`, fixed in `1.2.3` · CVSS 8.5 High · Not analysed yet · Published 5 Mar 2026 · Tags: Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI2LTAzLTA1VDIxOjQzOjE1LjAwMDAwMFoiLCJHSFNBLWZweDgtNzNnZi03eDczIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI2LTAzLTE4VDEyOjU5OjQyLjAwMDAwMFoiLCJHSFNBLTN4bTctcXc3ai1xYzh2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI2LTAzLTE4VDEyOjU5OjQyLjAwMDAwMFoiLCJHSFNBLTN4bTctcXc3ai1xYzh2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.