# Server-side request forgery (SSRF). The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery](https://agentprime.io/advisories/CVE-2026-104120.md) `CVE-2026-104120` · CVE record: modelcontextprotocol mcp-server-fetch and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF) - [Wormhole.app SSRF](https://agentprime.io/advisories/CVE-2026-100251.md) `CVE-2026-100251` · CVE record: Wormhole App Wormhole · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF) - [GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint](https://agentprime.io/advisories/CVE-2026-56661.md) `CVE-2026-56661` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF) - [GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction](https://agentprime.io/advisories/CVE-2026-56660.md) `CVE-2026-56660` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF), Unrestricted file upload, Server-side request forgery (SSRF) - [Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy](https://agentprime.io/advisories/CVE-2026-55232.md) `CVE-2026-55232` · CVE record: givanz Vvveb · CVSS 7.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF) - [OpenStack Swift vulnerable to authenticated server-side request forgery](https://agentprime.io/advisories/GHSA-h8rc-w822-q8vq.md) `GHSA-h8rc-w822-q8vq`, `CVE-2026-50221`, `PYSEC-2026-4173` · PyPI `swift`: affected `<2.37.2`, fixed in `2.37.2` · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF) - [JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs](https://agentprime.io/advisories/GHSA-3325-v43h-43rv.md) `GHSA-3325-v43h-43rv`, `BIT-jupyterlab-2026-102904`, `CVE-2026-102904`, `PYSEC-2026-4055` · PyPI `jupyterlab`: affected `>=4.0.0, <4.5.11 || >=4.6.0, <4.6.4`, fixed in `4.5.11`, `4.6.4` · CVSS 5.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Command injection, Information disclosure, Server-side request forgery (SSRF) - [Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation](https://agentprime.io/advisories/CVE-2026-103757.md) `CVE-2026-103757` · CVE record: Budibase budibase · CVSS 8.3 High · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF) - [Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch](https://agentprime.io/advisories/CVE-2026-103291.md) `CVE-2026-103291` · CVE record: TryGhost Ghost · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF) - [WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-103082.md) `CVE-2026-103082` · CVE record: LA-Studio LA-Studio Element Kit for Elementor · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103497.md) `CVE-2026-103497` · CVE record: JetBrains YouTrack · CVSS 5.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF) - [formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery](https://agentprime.io/advisories/CVE-2026-103542.md) `CVE-2026-103542` · CVE record: formtools.org Form Tools · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF) - [decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery](https://agentprime.io/advisories/CVE-2026-103530.md) `CVE-2026-103530` · CVE record: decolua 9Router · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Astro: Netlify Image CDN allowlist bypass enables SSRF](https://agentprime.io/advisories/GHSA-4233-jc72-56c5.md) `GHSA-4233-jc72-56c5`, `CVE-2026-102983` · npm `@astrojs/netlify`: affected `>=5.2.0, <8.2.4`, fixed in `8.2.4` · CVSS 6.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-625 - [LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters](https://agentprime.io/advisories/GHSA-3cv6-jpf6-8222.md) `GHSA-3cv6-jpf6-8222`, `CVE-2026-84377`, `PYSEC-2026-4066` · PyPI `litellm`: affected `<1.88.6 || >=1.89.0, <1.89.7 || >=1.90.0, <1.90.7 || >=1.91.0, <1.91.5 || >=1.92.0, <1.92.2 || >=1.93.0, <1.93.2 || >=1.94.0, <1.94.3 || >=1.95.0, <1.95.1 || >=1.96.0, <1.96.2`, fixed in `1.88.6`, `1.89.7`, `1.90.7`, `1.91.5`, `1.92.2`, `1.93.2`, `1.94.3`, `1.95.1`, `1.96.2` · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Kiteworks Email Protection Gateway server-side request forgery](https://agentprime.io/advisories/CVE-2026-102105.md) `CVE-2026-102105` · CVE record: Kiteworks Email Protection Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [iDocView SSRF via /doc/upload Endpoint Hardcoded Token](https://agentprime.io/advisories/CVE-2023-54402.md) `CVE-2023-54402` · CVE record: iDocView iDocView · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Kiteworks Email Protection Gateway server-side request forgery](https://agentprime.io/advisories/CVE-2026-102104.md) `CVE-2026-102104` · CVE record: Kiteworks Email Protection Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Kiteworks Email Protection Gateway server-side request forgery](https://agentprime.io/advisories/CVE-2026-102103.md) `CVE-2026-102103` · CVE record: Kiteworks Email Protection Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Kiteworks Email Protection Gateway server-side request forgery](https://agentprime.io/advisories/CVE-2026-102102.md) `CVE-2026-102102` · CVE record: Kiteworks Email Protection Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Kiteworks Core Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/CVE-2026-102138.md) `CVE-2026-102138` · CVE record: Kiteworks Core · CVSS 3.3 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Kiteworks Email Protection Gateway server-side request forgery](https://agentprime.io/advisories/CVE-2026-102095.md) `CVE-2026-102095` · CVE record: Kiteworks Email Protection Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Kiteworks Secure Data Forms server-side request forgery](https://agentprime.io/advisories/CVE-2026-102091.md) `CVE-2026-102091` · CVE record: Kiteworks Secure Data Forms · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present](https://agentprime.io/advisories/CVE-2026-101883.md) `CVE-2026-101883` · CVE record: OpenClaw OpenClaw Windows Node · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint](https://agentprime.io/advisories/CVE-2026-62308.md) `CVE-2026-62308` · CVE record: Quenary tugtainer · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100279.md) `CVE-2026-100279` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Server-side request forgery in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100257.md) `CVE-2026-100257` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls](https://agentprime.io/advisories/GHSA-3pq3-5fj3-cg6v.md) `GHSA-3pq3-5fj3-cg6v`, `CVE-2026-101898` · npm `axios`: affected `>=1.13.0, <1.20.0`, fixed in `1.20.0` · CVSS 7.0 High · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints](https://agentprime.io/advisories/CVE-2026-103243.md) `CVE-2026-103243` · CVE record: ModelTC LightLLM · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass](https://agentprime.io/advisories/CVE-2026-102577.md) `CVE-2026-102577` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass](https://agentprime.io/advisories/CVE-2026-97316.md) `CVE-2026-97316` · CVE record: Unknown Broken Link Notifier · CVSS 5.8 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF) - [PyJWT: PyJWKClient follows redirects when fetching JWKS](https://agentprime.io/advisories/GHSA-9v7f-9g4p-ffgj.md) `GHSA-9v7f-9g4p-ffgj`, `CVE-2026-102267`, `PYSEC-2026-4144` · PyPI `pyjwt`: affected `<2.14.0`, fixed in `2.14.0` · CVSS 7.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-345 - [ClaraVerse through 0.3.1 SSRF Protection Bypass](https://agentprime.io/advisories/CVE-2026-102879.md) `CVE-2026-102879` · CVE record: claraverse-space ClaraVerse · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Fider before 0.38.0 SSRF via DNS rebinding in webhook validation](https://agentprime.io/advisories/CVE-2026-102877.md) `CVE-2026-102877` · CVE record: getfider fider · CVSS 2.1 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5](https://agentprime.io/advisories/CVE-2026-100297.md) `CVE-2026-100297` · CVE record: Anjvision YSSD-RTMP-H5 · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs](https://agentprime.io/advisories/CVE-2026-76728.md) `CVE-2026-76728` · CVE record: Hewlett Packard Enterprise (HPE) Instant ON · CVSS 7.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Server-side request forgery (SSRF) - [The FTP client trusts arbitrary IP addresses in the PASV server response](https://agentprime.io/advisories/CVE-2026-102722.md) `CVE-2026-102722` · CVE record: Eclipse Foundation Eclipse ThreadX NetX Duo · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Joomla! Core - \[20260909\] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92222.md) `CVE-2026-92222` · CVE record: Joomla! Project Joomla! CMS · CVSS 8.9 High · Not analysed yet · Published 29 Sept 2026 · Tags: Server-side request forgery (SSRF) - [MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery](https://agentprime.io/advisories/CVE-2026-102244.md) `CVE-2026-102244` · CVE record: MODSetter SurfSense · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Server-side request forgery (SSRF) - [ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts](https://agentprime.io/advisories/GHSA-rpw4-54j3-4h4q.md) `GHSA-rpw4-54j3-4h4q`, `CVE-2026-101913` · npm `ip-address`: affected `<10.5.1`, fixed in `10.5.1` · CVSS 6.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-697 - [ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass](https://agentprime.io/advisories/GHSA-2vr4-cq9g-pvrc.md) `GHSA-2vr4-cq9g-pvrc`, `CVE-2026-101910` · npm `ip-address`: affected `>=10.2.0, <10.5.1`, fixed in `10.5.1` · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF) - [jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization](https://agentprime.io/advisories/GHSA-vvgp-rfg2-7rr6.md) `GHSA-vvgp-rfg2-7rr6`, `CVE-2026-77310` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.0.0, <2.18.9 || >=2.19.0, <2.21.5 || >=2.22.0, <2.22.1`, fixed in `2.18.9`, `2.21.5`, `2.22.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer](https://agentprime.io/advisories/CVE-2026-55160.md) `CVE-2026-55160` · CVE record: stringer-rss stringer · CVSS 7.6 High · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF) - [SSRF via DNS-resolution gap in \_validate_url_security (file download by URL)](https://agentprime.io/advisories/CVE-2026-55096.md) `CVE-2026-55096` · CVE record: leshchenko1979 fast-mcp-telegram · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-184 - [Apache Roller: Server-side request forgery via entry trackback and enclosure URLs](https://agentprime.io/advisories/CVE-2026-82375.md) `CVE-2026-82375` · CVE record: Apache Software Foundation Apache Roller · CVSS 7.4 High · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla](https://agentprime.io/advisories/CVE-2026-100750.md) `CVE-2026-100750` · CVE record: regularlabs.com Modules Anywhere (Pro) extension for Joomla · CVSS 8.5 High · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF) - [October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery](https://agentprime.io/advisories/CVE-2026-101005.md) `CVE-2026-101005` · CVE record: October CMS · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF) - [athlon1600 youtube-downloader stream.php stream server-side request forgery](https://agentprime.io/advisories/CVE-2026-100901.md) `CVE-2026-100901` · CVE record: athlon1600 youtube-downloader · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF) - [DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery](https://agentprime.io/advisories/CVE-2026-100900.md) `CVE-2026-100900` · CVE record: DevaslanPHP project-management · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery](https://agentprime.io/advisories/CVE-2026-100893.md) `CVE-2026-100893` · CVE record: Privoce VoceChat Server · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6](https://agentprime.io/advisories/CVE-2026-101087.md) `CVE-2026-101087` · CVE record: nezhahq nezha · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF) - [utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass](https://agentprime.io/advisories/CVE-2026-101061.md) `CVE-2026-101061` · CVE record: universal-tool-calling-protocol python-utcp · CVSS 2.3 Low · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF) - [python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects](https://agentprime.io/advisories/CVE-2026-101060.md) `CVE-2026-101060` · CVE record: universal-tool-calling-protocol python-utcp · CVSS 8.4 High · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF) - [utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass](https://agentprime.io/advisories/CVE-2026-101059.md) `CVE-2026-101059` · CVE record: universal-tool-calling-protocol python-utcp · CVSS 7.1 High · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF) - [python-utcp before 1.1.12 SSRF via Remote HTTP Manual](https://agentprime.io/advisories/CVE-2026-101058.md) `CVE-2026-101058` · CVE record: universal-tool-calling-protocol python-utcp · CVSS 7.1 High · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF) - [WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview](https://agentprime.io/advisories/CVE-2026-89003.md) `CVE-2026-89003` · CVE record: Unknown WPeMatico RSS Feed Fetcher · CVSS 4.1 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF) - [WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run](https://agentprime.io/advisories/CVE-2026-89000.md) `CVE-2026-89000` · CVE record: Unknown WPeMatico RSS Feed Fetcher · CVSS 4.1 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Heym before 0.0.91 SSRF via image fetching and IPv6 validation](https://agentprime.io/advisories/CVE-2026-100863.md) `CVE-2026-100863` · CVE record: heymrun heym · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF) - [heym before 0.0.105 SSRF via credential-controlled base URLs](https://agentprime.io/advisories/CVE-2026-100861.md) `CVE-2026-100861` · CVE record: heymrun heym · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Heym before 0.0.106 Credential Exfiltration via URL Override](https://agentprime.io/advisories/CVE-2026-100859.md) `CVE-2026-100859` · CVE record: heymrun heym · CVSS 7.1 High · Not analysed yet · Published 27 Sept 2026 · Tags: Server-side request forgery (SSRF) Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .