Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.6 High
Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints
- kubeflow pipelines
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator
- kubeflow pipelines
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy
- kubeflow pipelines
- Hard-coded credentials
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation
- kubeflow pipelines
- Server-side request forgery (SSRF)
- CWE-441
- CVSS 6.9 Medium
KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF
- kurrent-io KurrentDB
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 7.7 High
SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
- SuiteCRM
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Posta before v0.18.0 SSRF via Webhook URL
- posta
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API
- jarun buku
- Server-side request forgery (SSRF)
- CVSS 7.7 High
SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services
- SuiteCRM
- Server-side request forgery (SSRF)
- CVSS 7.1 High
SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron
- SuiteCRM
- Broken access control
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass
- sensiolabs symfony
- Server-side request forgery (SSRF)
- CWE-184
- CVSS 5.3 Medium
Server-side request forgery in Trellix DLP on-prem extensions
- Trellix DLP on-prem extensions
- Server-side request forgery (SSRF)
-
Apache OFBiz: Server-side request forgery in SurveyWrapper
- Apache Software Foundation Apache OFBiz
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
- Apache Software Foundation Apache OFBiz
- Broken access control
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
- sensiolabs symfony
- Race condition
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
Webmin: SSRF exploit in Upload and Download and File Manager modules
- webmin
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy
- readest
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
- jgraph drawio
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass
- germondai trawl
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
DataLinkDC Dinky flink_web Proxy Endpoint FlinkWebURITemplateProxyServlet.java FlinkWebURITemplateProxyServlet.getNewTargetUri server-side request forgery
- DataLinkDC Dinky
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery
- InfiniFlow RAGFlow
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Oqtane Framework before 10.3.0 SSRF via File Upload From URL
- oqtane.framework
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API
- cosin2077 easyVoice
- Server-side request forgery (SSRF)
- CVSS 8.4 High
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
- Coupa Total Spend Management Platform
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path
- Stape Conversion Tracking
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import
- PowerPack Addons for Elementor: Widgets, Form Styler and Templates
- Server-side request forgery (SSRF)
- CVSS 8.2 High
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
- MLflow
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
ArcReel Provider Test-Connection Endpoint test server-side request forgery
- ArcReel
- Server-side request forgery (SSRF)
-
Server-side request forgery in Devolutions Server
- Devolutions Server
- Server-side request forgery (SSRF)
-
Server-side request forgery in Devolutions Server
- Devolutions Server
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Server-Side Request Forgery in Tapo Cloud MQTT Proxy
- TP-Link Systems Inc. Tapo Cloud Service
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Server-side request forgery via SpatialReference string input
- Django
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Server-side request forgery via crs member of GeoJSON geometries
- Django
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads
- HumanSignal label-studio
- HumanSignal label-studio-sdk
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors
- AzuraCast
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
SurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass
- surrealdb
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SurrealDB 3.1.0 before 3.3.0 SSRF via Port-Specific --deny-net Host Aliasing Bypass
- surrealdb
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
SurrealDB 3.2.0 before 3.3.0 SSRF Guard Bypass via IPv6 Transition Addresses
- surrealdb
- Server-side request forgery (SSRF)
- CVSS 9.2 CriticalCritical · CVSS 9+
Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures
- Eclipse Foundation Eclipse Mnestix
- Hard-coded credentials
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
TYPO3-EXT-SA-2026-037: Server-Side Request Forgery in extension "Mail" (mail)
- Server-side request forgery (SSRF)
<3.12.5 || >=4.0.0, <4.2.0 · fixed in 3.12.5, 4.2.0
PKSA-spg7-jb73-vpnk · CVE-2026-120331 - CVSS 5.8 Medium
Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter
- Gallery for Social Photo
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
AndyFactory newspaper4k Image Extractor image_extractor.py Article.parse server-side request forgery
- AndyFactory newspaper4k
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Rancher meta proxy allowlist bypass leading to server-side request forgery
- SUSE Rancher
- Server-side request forgery (SSRF)
-
Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher
- Server-side request forgery (SSRF)
>=2.28.0-beta.2, <2.34.0 · fixed in 2.34.0
GHSA-7wpf-ch8f-5f4x · CVE-2026-115752 - CVSS 4.8 Medium
NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571
- Server-side request forgery (SSRF)
<8.51.0 · fixed in 8.51.0
GHSA-c6q7-wqw2-h65w · CVE-2026-54442 - CVSS 7.1 High
Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion
- christianhelle refitter
- Server-side request forgery (SSRF)
- CWE-829
- CVSS 6.8 Medium
Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read
- Stirling-Tools Stirling-PDF
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass
- Stirling-Tools Stirling-PDF
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 7.1 High
pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name
- pgadmin.org pgAdmin 4
- Command injection
- Hard-coded credentials
- CVSS 9.1 CriticalCritical · CVSS 9+
PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
- madeofpendletonwool PinePods
- Server-side request forgery (SSRF)
- CVSS 8.6 High
OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
- osac-project osac-operator
- Code injection
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services
- vantern-org questbot
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
- pipeshub-ai
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata
- goniszewski grimoire
- Server-side request forgery (SSRF)
- CVSS 3.1 Low
Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard
- basecamp once-campfire
- Server-side request forgery (SSRF)
- CVSS 7.1 High
ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
- ArcadeData arcadedb
- Server-side request forgery (SSRF)
- CVSS 2.7 Low
Server-side request forgery in Dell OpenManage Enterprise
- Dell OpenManage Enterprise
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
- jellyfin
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
- forgejo
- Server-side request forgery (SSRF)