# Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check](https://agentprime.io/advisories/CVE-2026-111320.md)
  `CVE-2026-111320` · CVE record: ValueCell-ai ValueCell · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch](https://agentprime.io/advisories/CVE-2026-111313.md)
  `CVE-2026-111313` · CVE record: DaKheera47 JobOps · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication](https://agentprime.io/advisories/GHSA-637c-6jxx-4rwm.md)
  `GHSA-637c-6jxx-4rwm`, `CVE-2026-77524`, `GO-2026-6776` · Go `github.com/kedacore/keda` and 1 more: affected `<=1.5.0`, no fixed version yet · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Privilege escalation, Server-side request forgery (SSRF)
- [AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction](https://agentprime.io/advisories/CVE-2026-94621.md)
  `CVE-2026-94621` · CVE record: aliasvault aliasvault and 3 more · CVSS 6.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network](https://agentprime.io/advisories/CVE-2026-55875.md)
  `CVE-2026-55875` · CVE record: HeliumEdu platform · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune](https://agentprime.io/advisories/CVE-2026-110812.md)
  `CVE-2026-110812` · CVE record: AWS Amazon Neptune Engine · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization, Server-side request forgery (SSRF)
- [Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation](https://agentprime.io/advisories/CVE-2026-57569.md)
  `CVE-2026-57569` · CVE record: LycheeOrg Lychee · CVSS 2.3 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames](https://agentprime.io/advisories/CVE-2026-18660.md)
  `CVE-2026-18660` · CVE record: Eclipse Foundation · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Server-side request forgery (SSRF), CWE-178
- [SSRF in QNAP Download Station](https://agentprime.io/advisories/CVE-2026-39989.md)
  `CVE-2026-39989` · CVE record: QNAP Systems Inc. Download Station · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter](https://agentprime.io/advisories/CVE-2026-3712.md)
  `CVE-2026-3712` · CVE record: kiboit PhastPress · CVSS 7.3 High · Not analysed yet · Published 15 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component.](https://agentprime.io/advisories/CVE-2026-78850.md)
  `CVE-2026-78850` · CVE record · CVSS 5.0 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources](https://agentprime.io/advisories/CVE-2026-110868.md)
  `CVE-2026-110868` · CVE record: renovatebot renovate and 4 more · CVSS 8.4 High · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability](https://agentprime.io/advisories/CVE-2026-0311.md)
  `CVE-2026-0311` · CVE record: Palo Alto Networks Checkov by Prisma Cloud · CVSS 1.1 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [InvoiceShelf: SSRF via unvalidated Gotenberg PDF renderer host in PDF configuration](https://agentprime.io/advisories/CVE-2026-55385.md)
  `CVE-2026-55385` · CVE record: InvoiceShelf InvoiceShelf · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker](https://agentprime.io/advisories/CVE-2026-102354.md)
  `CVE-2026-102354` · CVE record: alam00000 bentopdf · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Race condition, Server-side request forgery (SSRF)
- [Redash: JSON data source query URL can bypass base URL restriction](https://agentprime.io/advisories/CVE-2026-76083.md)
  `CVE-2026-76083` · CVE record: getredash redash · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header](https://agentprime.io/advisories/CVE-2026-110719.md)
  `CVE-2026-110719` · CVE record: Portkey-AI gateway · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download](https://agentprime.io/advisories/CVE-2026-110718.md)
  `CVE-2026-110718` · CVE record: TurboDocx html-to-docx · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Gitea blind SSRF through OpenID assertion verification](https://agentprime.io/advisories/CVE-2026-78231.md)
  `CVE-2026-78231` · CVE record: Gitea Gitea · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Gitea OpenID discovery server-side request forgery](https://agentprime.io/advisories/CVE-2026-25946.md)
  `CVE-2026-25946` · CVE record: Gitea Gitea · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment](https://agentprime.io/advisories/CVE-2026-110628.md)
  `CVE-2026-110628` · CVE record: kanbn kan · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [ruoyi-vue-pro through 2026.09 SSRF via Midjourney referImageUrl and notify imageUrl](https://agentprime.io/advisories/CVE-2026-110610.md)
  `CVE-2026-110610` · CVE record: YunaiV ruoyi-vue-pro · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass](https://agentprime.io/advisories/CVE-2026-110652.md)
  `CVE-2026-110652` · CVE record: ONLYOFFICE DocumentServer · CVSS 6.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data](https://agentprime.io/advisories/CVE-2026-85345.md)
  `CVE-2026-85345` · CVE record: Unknown FV Flowplayer Video Player · CVSS 4.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-95634.md)
  `CVE-2026-95634` · CVE record: Adobe Content Credentials Rust SDK and 2 more · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-105897.md)
  `CVE-2026-105897` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-34633.md)
  `CVE-2026-34633` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-106622.md)
  `CVE-2026-106622` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-34634.md)
  `CVE-2026-34634` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-76001.md)
  `CVE-2026-76001` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-75748.md)
  `CVE-2026-75748` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 7.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint](https://agentprime.io/advisories/CVE-2026-110255.md)
  `CVE-2026-110255` · CVE record: Finsys dockhand · CVSS 8.4 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory](https://agentprime.io/advisories/CVE-2026-110254.md)
  `CVE-2026-110254` · CVE record: Finsys dockhand · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-88206.md)
  `CVE-2026-88206` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70202.md)
  `CVE-2026-70202` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Azure Arc Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-96204.md)
  `CVE-2026-96204` · CVE record: Microsoft Arc Enabled Servers - Azure Connected Machine Agent · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Office SharePoint Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-70259.md)
  `CVE-2026-70259` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70251.md)
  `CVE-2026-70251` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Microsoft Office SharePoint Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-105713.md)
  `CVE-2026-105713` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 5.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Lancet through 2.3.9 SSRF Protection Bypass via netutil.IsInternalIP](https://agentprime.io/advisories/CVE-2026-110240.md)
  `CVE-2026-110240` · CVE record: duke-git lancet · CVSS 6.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route](https://agentprime.io/advisories/CVE-2026-110225.md)
  `CVE-2026-110225` · CVE record: shaarli Shaarli · CVSS 5.1 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint](https://agentprime.io/advisories/CVE-2026-110223.md)
  `CVE-2026-110223` · CVE record: Kareadita Kavita · CVSS 2.3 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup](https://agentprime.io/advisories/CVE-2026-110222.md)
  `CVE-2026-110222` · CVE record: Razorpay IFSC · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation](https://agentprime.io/advisories/CVE-2026-110220.md)
  `CVE-2026-110220` · CVE record: Kubeflow Model Registry · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Misskey: Lack of rate limiting and size restrictions in RSS fetching API](https://agentprime.io/advisories/CVE-2026-104817.md)
  `CVE-2026-104817` · CVE record: misskey-dev misskey · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Denial of service, Server-side request forgery (SSRF), CWE-405
- [Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding](https://agentprime.io/advisories/CVE-2026-107460.md)
  `CVE-2026-107460` · CVE record: Apache Software Foundation Apache Fesod (Incubating) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in NVIDIA AIStore framework](https://agentprime.io/advisories/CVE-2026-65101.md)
  `CVE-2026-65101` · CVE record: NVIDIA AIStore framework · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Server-side request forgery in NVIDIA AIStore framework](https://agentprime.io/advisories/CVE-2026-65170.md)
  `CVE-2026-65170` · CVE record: NVIDIA AIStore framework · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery](https://agentprime.io/advisories/CVE-2026-109405.md)
  `CVE-2026-109405` · CVE record: conductor-oss conductor · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery](https://agentprime.io/advisories/CVE-2026-109404.md)
  `CVE-2026-109404` · CVE record: conductor-oss conductor · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery](https://agentprime.io/advisories/CVE-2026-109403.md)
  `CVE-2026-109403` · CVE record: conductor-oss conductor · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery](https://agentprime.io/advisories/CVE-2026-109402.md)
  `CVE-2026-109402` · CVE record: conductor-oss conductor · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery](https://agentprime.io/advisories/CVE-2026-109190.md)
  `CVE-2026-109190` · CVE record: conductor-oss conductor · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [fit2cloud MeterSphere Swagger3 Swagger3ParserApiDefinition.java Swagger3ParserApiDefinition.testUrlTimeout server-side request forgery](https://agentprime.io/advisories/CVE-2026-109189.md)
  `CVE-2026-109189` · CVE record: fit2cloud MeterSphere · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Server-Side Request Forgery (SSRF) in GitLab](https://agentprime.io/advisories/CVE-2026-100104.md)
  `CVE-2026-100104` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [OAuth2 SSRF vulnerability in SAP Cloud SDK for Python](https://agentprime.io/advisories/CVE-2026-89111.md)
  `CVE-2026-89111` · CVE record: SAP_SE SAP Cloud · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a…](https://agentprime.io/advisories/CVE-2024-34319.md)
  `CVE-2024-34319` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery](https://agentprime.io/advisories/CVE-2026-108939.md)
  `CVE-2026-108939` · CVE record: EricLBuehler mistral.rs · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field](https://agentprime.io/advisories/CVE-2026-109651.md)
  `CVE-2026-109651` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit](https://agentprime.io/advisories/CVE-2026-109603.md)
  `CVE-2026-109603` · CVE record: frappe frappe · CVSS 4.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Server-side request forgery (SSRF)

Newest: <https://agentprime.io/advisories/tag/ssrf.md>
Older: <https://agentprime.io/advisories/tag/ssrf.md?cursor=WyIyMDI2LTEwLTEyVDIyOjIxOjU1LjgwNDAwMFoiLCJDVkUtMjAyNi0xMDk2MDMiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=ssrf&cursor=WyIyMDI2LTEwLTE1VDIxOjQzOjMwLjI1NDAwMFoiLCJDVkUtMjAyNi0xMTEzMjEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/ssrf/?cursor=WyIyMDI2LTEwLTE1VDIxOjQzOjMwLjI1NDAwMFoiLCJDVkUtMjAyNi0xMTEzMjEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.