# Server-side request forgery (SSRF). The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Page-Replica Page Replica Endpoint sitemap sitemap.fetch server-side request forgery](https://agentprime.io/advisories/CVE-2026-4907.md) `CVE-2026-4907` · CVE record: Page-Replica Page Replica · CVSS 5.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before.](https://agentprime.io/advisories/CVE-2026-30637.md) `CVE-2026-30637` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs](https://agentprime.io/advisories/CVE-2026-33644.md) `CVE-2026-33644` · CVE record: LycheeOrg Lychee · CVSS 2.3 Low · Not analysed yet · Published 26 Mar 2026 · Tags: Server-side request forgery (SSRF) - [OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025](https://agentprime.io/advisories/CVE-2026-3530.md) `CVE-2026-3530` · CVE record: Drupal OpenID Connect / OAuth client · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked](https://agentprime.io/advisories/CVE-2026-33537.md) `CVE-2026-33537` · CVE record: LycheeOrg Lychee · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Server-side request forgery (SSRF) - [AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints](https://agentprime.io/advisories/GHSA-f359-r3pv-2phf.md) `GHSA-f359-r3pv-2phf`, `CVE-2026-33766`, `PKSA-37q2-fmsd-htgf` · Packagist `wwbn/avideo`: affected `<=26.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation](https://agentprime.io/advisories/CVE-2026-32857.md) `CVE-2026-32857` · CVE record: Firecrawl Firecrawl · CVSS 7.8 High · Not analysed yet · Published 26 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation](https://agentprime.io/advisories/GHSA-22rm-wp4x-v5cx.md) `GHSA-22rm-wp4x-v5cx`, `CVE-2026-4874` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.6.3 || <26.4.13`, fixed in `26.6.3`, `26.4.13` · CVSS 3.1 Low · Not analysed yet · Published 26 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL](https://agentprime.io/advisories/GHSA-c83f-3xp6-hfcp.md) `GHSA-c83f-3xp6-hfcp`, `CVE-2026-33182`, `PKSA-5szq-gvrg-ttfq` · Packagist `saloonphp/saloon`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 6.6 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Hard-coded credentials, Server-side request forgery (SSRF) - [Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)](https://agentprime.io/advisories/GHSA-7p48-42j8-8846.md) `GHSA-7p48-42j8-8846`, `CVE-2026-33682`, `PYSEC-2026-2285` · PyPI `streamlit`: affected `<1.54.0`, fixed in `1.54.0` · CVSS 4.7 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download](https://agentprime.io/advisories/GHSA-g9xj-752q-xh63.md) `GHSA-g9xj-752q-xh63`, `CVE-2026-33679`, `GO-2026-4852` · Go `code.vikunja.io/api`: affected `<2.2.1`, fixed in `2.2.1` · CVSS 6.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources](https://agentprime.io/advisories/GHSA-g66v-54v9-52pr.md) `GHSA-g66v-54v9-52pr`, `CVE-2026-33675`, `GO-2026-4851` · Go `code.vikunja.io/api`: affected `<2.2.1`, fixed in `2.2.1` · CVSS 6.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Server-side request forgery (SSRF) - [IBM InfoSphere Information Server is vulnerable to server-side request forgery](https://agentprime.io/advisories/CVE-2026-1015.md) `CVE-2026-1015` · CVE record: IBM InfoSphere Information Server · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()](https://agentprime.io/advisories/GHSA-q537-8fr5-cw35.md) `GHSA-q537-8fr5-cw35`, `CVE-2026-33693` · crates.io `activitypub_federation`: affected `<0.7.0-beta.9`, fixed in `0.7.0-beta.9` · CVSS 6.5 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Server-side request forgery (SSRF) - [IBM InfoSphere Information Server is vulnerable to server-side request forgery](https://agentprime.io/advisories/CVE-2025-14912.md) `CVE-2025-14912` · CVE record: IBM InfoSphere Information Server · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Server-side request forgery (SSRF) - [IBM WebSphere Application Server Liberty Server-Side Request Forgery](https://agentprime.io/advisories/CVE-2026-1561.md) `CVE-2026-1561` · CVE record: IBM WebSphere Application Server Liberty · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Server-side request forgery (SSRF) - [AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php](https://agentprime.io/advisories/GHSA-wxjx-r2j2-96fx.md) `GHSA-wxjx-r2j2-96fx`, `PKSA-6bhm-ppng-rh7j` · Packagist `wwbn/avideo`: affected `<=26.0`, no fixed version yet · CVSS 4.9 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Server-side request forgery (SSRF) - [WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-24964.md) `CVE-2026-24964` · CVE record: Wasiliy Strecker / ContestGallery developer Contest Gallery · CVSS 6.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017](https://agentprime.io/advisories/CVE-2026-3216.md) `CVE-2026-3216` · CVE record: Drupal Drupal Canvas · CVSS 5.0 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Server-side request forgery (SSRF) - [PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl](https://agentprime.io/advisories/GHSA-xqq2-4j46-vwp7.md) `GHSA-xqq2-4j46-vwp7`, `CVE-2026-33619`, `GO-2026-4825` · Go `github.com/pinchtab/pinchtab`: affected `<0.8.4`, fixed in `0.8.4` · CVSS 4.1 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php](https://agentprime.io/advisories/CVE-2026-33401.md) `CVE-2026-33401` · CVE record: ellite Wallos · CVSS 7.1 High · Not analysed yet · Published 24 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840](https://agentprime.io/advisories/CVE-2026-33399.md) `CVE-2026-33399` · CVE record: ellite Wallos · CVSS 7.7 High · Not analysed yet · Published 24 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Wallos: SSRF via HTTP Proxy Environment Variable](https://agentprime.io/advisories/CVE-2026-33407.md) `CVE-2026-33407` · CVE record: ellite Wallos · CVSS 8.3 High · Not analysed yet · Published 24 Mar 2026 · Tags: Server-side request forgery (SSRF), Information disclosure - [LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint](https://agentprime.io/advisories/CVE-2026-33340.md) `CVE-2026-33340` · CVE record: ParisNeo lollms-webui · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.22 · Not analysed yet · Published 24 Mar 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF) - [DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery](https://agentprime.io/advisories/CVE-2026-4623.md) `CVE-2026-4623` · CVE record: DefaultFuction Jeson-Customer-Relationship-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents](https://agentprime.io/advisories/GHSA-rc55-58f4-687g.md) `GHSA-rc55-58f4-687g`, `CVE-2026-33486`, `PKSA-8x28-rsr9-rfb8` · Packagist `roadiz/documents`: affected `<2.3.42 || >=2.4.0, <2.5.44 || >=2.6.0, <2.6.28 || >=2.7.0, <2.7.9`, fixed in `2.3.42`, `2.5.44`, `2.6.28`, `2.7.9` · CVSS 6.8 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin](https://agentprime.io/advisories/GHSA-jh46-85jr-6ph9.md) `GHSA-jh46-85jr-6ph9`, `CVE-2026-32279`, `PKSA-h93g-m9xg-91qb` · Packagist `opensource-workshop/connect-cms`: affected `<1.41.1 || >=2.0.0, <2.41.1`, fixed in `1.41.1`, `2.41.1` · CVSS 6.8 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Server-side request forgery (SSRF) - [kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery](https://agentprime.io/advisories/CVE-2026-4589.md) `CVE-2026-4589` · CVE record: kalcaddle kodbox · CVSS 5.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Server-side request forgery (SSRF) - [trueleaf ApiFlow URL Validation http_proxy.service.ts validateUrlSecurity server-side request forgery](https://agentprime.io/advisories/CVE-2026-4528.md) `CVE-2026-4528` · CVE record: trueleaf ApiFlow · CVSS 6.9 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Content Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter](https://agentprime.io/advisories/CVE-2026-3478.md) `CVE-2026-3478` · CVE record: benmoody Content Syndication Toolkit · CVSS 7.2 High · Not analysed yet · Published 21 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Performance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter](https://agentprime.io/advisories/CVE-2026-1648.md) `CVE-2026-1648` · CVE record: qrolic Performance Monitor · CVSS 7.2 High · Not analysed yet · Published 21 Mar 2026 · Tags: Server-side request forgery (SSRF) - [MimeTypes Link Icons <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content](https://agentprime.io/advisories/CVE-2026-1313.md) `CVE-2026-1313` · CVE record: eagerterrier MimeTypes Link Icons · CVSS 8.3 High · Not analysed yet · Published 21 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Post Affiliate Pro <= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field](https://agentprime.io/advisories/CVE-2026-2290.md) `CVE-2026-2290` · CVE record: jurajsim Post Affiliate Pro · CVSS 3.8 Low · Not analysed yet · Published 21 Mar 2026 · Tags: Server-side request forgery (SSRF) - [WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API](https://agentprime.io/advisories/CVE-2026-4302.md) `CVE-2026-4302` · CVE record: wpxpo WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation · CVSS 7.2 High · Not analysed yet · Published 21 Mar 2026 · Tags: Server-side request forgery (SSRF) - [AVideo has Unauthenticated SSRF via plugin/Live/test.php](https://agentprime.io/advisories/GHSA-3fpm-8rjr-v5mc.md) `GHSA-3fpm-8rjr-v5mc`, `CVE-2026-33502`, `PKSA-734r-s438-vkf3` · Packagist `wwbn/avideo`: affected `<=26.0`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Server-side request forgery (SSRF) - [PDFME has SSRF via Unvalidated URL Fetch in \`getB64BasePdf\` When \`basePdf\` Is Attacker-Controlled](https://agentprime.io/advisories/GHSA-pgx6-7jcq-2qff.md) `GHSA-pgx6-7jcq-2qff`, `CVE-2026-82866` · npm `@pdfme/common`: affected `<5.5.10`, fixed in `5.5.10` · CVSS 8.9 High · Not analysed yet · Published 20 Mar 2026 · Tags: Server-side request forgery (SSRF) - [AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy](https://agentprime.io/advisories/GHSA-p3gr-g84w-g8hh.md) `GHSA-p3gr-g84w-g8hh`, `CVE-2026-33480`, `PKSA-8d9c-5xxm-8vns` · Packagist `wwbn/avideo`: affected `<=26.0`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Frigate has SSRF vulnerability in /ffprobe endpoint](https://agentprime.io/advisories/CVE-2026-33126.md) `CVE-2026-33126` · CVE record: blakeblackshear frigate · CVSS 5.0 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Server-side request forgery (SSRF) - [AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator](https://agentprime.io/advisories/CVE-2026-33024.md) `CVE-2026-33024` · CVE record: WWBN AVideo-Encoder · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Server-side request forgery (SSRF) - [SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL](https://agentprime.io/advisories/CVE-2026-32949.md) `CVE-2026-32949` · CVE record: dataease SQLBot · CVSS 8.7 High · Not analysed yet · Published 20 Mar 2026 · Tags: Path traversal, Server-side request forgery (SSRF) - [SuiteCRM vulnerable to authenticated SSRF via PDF export](https://agentprime.io/advisories/CVE-2026-29107.md) `CVE-2026-29107` · CVE record: SuiteCRM SuiteCRM · CVSS 5.0 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet](https://agentprime.io/advisories/CVE-2026-29097.md) `CVE-2026-29097` · CVE record: SuiteCRM SuiteCRM · CVSS 7.1 High · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft Exchange Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-26137.md) `CVE-2026-26137` · CVE record: Microsoft Microsoft Exchange Online · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft Bing Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-26120.md) `CVE-2026-26120` · CVE record: Microsoft Microsoft Bing · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft Purview Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-26138.md) `CVE-2026-26138` · CVE record: Microsoft Microsoft Purview · CVSS 8.6 High · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Microsoft Purview Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-26139.md) `CVE-2026-26139` · CVE record: Microsoft Microsoft Purview · CVSS 8.6 High · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Azure Cloud Shell Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-32169.md) `CVE-2026-32169` · CVE record: Microsoft Azure Cloud Shell · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)](https://agentprime.io/advisories/CVE-2026-33321.md) `CVE-2026-33321` · CVE record: openemr openemr · CVSS 7.2 High · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [AVideo has Unauthenticated SSRF via \`webSiteRootURL\` Parameter in saveDVR.json.php, Chaining to Verification Bypass](https://agentprime.io/advisories/GHSA-5f7v-4f6g-74rj.md) `GHSA-5f7v-4f6g-74rj`, `CVE-2026-33351`, `PKSA-kz4k-1fdq-4jkn` · Packagist `wwbn/avideo`: affected `<=26.0`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [league/commonmark has an embed extension allowed_domains bypass](https://agentprime.io/advisories/GHSA-hh8v-hgvp-g3f5.md) `GHSA-hh8v-hgvp-g3f5`, `CVE-2026-33347`, `PKSA-21fb-n1x5-5nf7` · Packagist `league/commonmark`: affected `>=2.3.0, <2.8.2`, fixed in `2.8.2` · CVSS 6.3 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Cross-site scripting (XSS), Server-side request forgery (SSRF), CWE-185 - [AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources](https://agentprime.io/advisories/GHSA-66cw-h2mj-j39p.md) `GHSA-66cw-h2mj-j39p`, `CVE-2026-33294`, `PKSA-69wq-d8c2-6qbn` · Packagist `wwbn/avideo`: affected `<=25.0`, no fixed version yet · CVSS 5.0 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS](https://agentprime.io/advisories/CVE-2025-71259.md) `CVE-2025-71259` · CVE record: BMC Software, Inc. FootPrints · CVSS 5.3 Medium · EPSS 0.12 · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb](https://agentprime.io/advisories/CVE-2025-71258.md) `CVE-2025-71258` · CVE record: BMC Software, Inc. FootPrints · CVSS 5.3 Medium · EPSS 0.17 · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [AVideo has SSRF in Scheduler Plugin via callbackURL Missing \`isSSRFSafeURL()\` Validation](https://agentprime.io/advisories/GHSA-v467-g7g7-hhfh.md) `GHSA-v467-g7g7-hhfh`, `CVE-2026-33237`, `PKSA-1msk-y5kh-hb4p` · Packagist `wwbn/avideo`: affected `<26.0`, fixed in `26.0` · CVSS 5.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy](https://agentprime.io/advisories/GHSA-44c9-4rg5-qjgq.md) `GHSA-44c9-4rg5-qjgq` · npm `openclaw`: affected `*`, no fixed version yet · CVSS 7.4 High · Withdrawn · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability.](https://agentprime.io/advisories/CVE-2026-30404.md) `CVE-2026-30404` · CVE record · CVSS 7.5 High · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint](https://agentprime.io/advisories/CVE-2026-32255.md) `CVE-2026-32255` · CVE record: kanbn kan · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.29 · Not analysed yet · Published 18 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview](https://agentprime.io/advisories/GHSA-4647-wpjq-hh7f.md) `GHSA-4647-wpjq-hh7f`, `CVE-2026-33226` · npm `budibase`: affected `<=3.30.6`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 18 Mar 2026 · Tags: Server-side request forgery (SSRF) - [PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation](https://agentprime.io/advisories/GHSA-qwxp-6qf9-wr4m.md) `GHSA-qwxp-6qf9-wr4m`, `CVE-2026-33081`, `GO-2026-4748` · Go `github.com/pinchtab/pinchtab`: affected `<0.8.3`, fixed in `0.8.3` · CVSS 5.8 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Server-side request forgery (SSRF) - [SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks](https://agentprime.io/advisories/GHSA-3xm7-qw7j-qc8v.md) `GHSA-3xm7-qw7j-qc8v`, `CVE-2026-33060` · npm `@aborruso/ckan-mcp-server`: affected `<0.4.85`, fixed in `0.4.85` · CVSS 5.3 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Server-side request forgery (SSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .