Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
Ech0 has Unauthenticated Server-Side Request Forgery in Website Preview Feature
- Server-side request forgery (SSRF)
<1.4.8-0.20260401031029-4ca56fea5ba4 · fixed in 1.4.8-0.20260401031029-4ca56fea5ba4
GHSA-wc4h-2348-jc3p · CVE-2026-35036 - CVSS 9.6 CriticalCritical · CVSS 9+
Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability
- Microsoft Azure Custom Locations Resource Provider
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Azure Databricks Elevation of Privilege Vulnerability
- Microsoft Azure Databricks
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery
- Server-side request forgery (SSRF)
<2026.3.31 · fixed in 2026.3.31
GHSA-9q7v-8mr7-g23p · CVE-2026-41302 - CVSS 6.9 Medium
appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery
- appsmith
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery
- Dataease SQLbot
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
- gitroomhq postiz-app
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
- gitroomhq postiz-app
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
- gitroomhq postiz-app
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery
- huimeicloud hm_editor
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function
- Server-side request forgery (SSRF)
<1.0.5 · fixed in 1.0.5
GHSA-prmx-7v35-7q82 · CVE-2026-5323 - CVSS 7.2 High
Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery
- pfefferle Webmention
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery
- pfefferle Webmention
- Server-side request forgery (SSRF)
- CVSS 8.6 High
PraisonAI Has SSRF in FileTools.download_file() via Unvalidated URL
- Server-side request forgery (SSRF)
<1.5.95 · fixed in 1.5.95
GHSA-44c2-3rw4-5gvh · CVE-2026-34954 - CVSS 7.7 High
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
- Server-side request forgery (SSRF)
<4.5.90 · fixed in 4.5.90
GHSA-x6m9-gxvr-7jpv · CVE-2026-34936 - CVSS 5.0 Medium
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
- Server-side request forgery (SSRF)
<1.17.0 · fixed in 1.17.0
GHSA-wm7j-m6jm-8797 · CVE-2026-34526 - CVSS 6.6 Medium
AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
- Path traversal
- Server-side request forgery (SSRF)
<3.13.4 · fixed in 3.13.4
GHSA-p998-jp59-783m · CVE-2026-34515 - CVSS 7.7 High
Payload has Authenticated SSRF via Upload Functionality
- Server-side request forgery (SSRF)
<3.79.1 · fixed in 3.79.1
GHSA-6r7f-q7f5-wpx8 · CVE-2026-34746 - CVSS 6.5 Medium
AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation
- Server-side request forgery (SSRF)
<=26.0 · no fixed version yet
GHSA-x5vx-vrpf-r45f · CVE-2026-34740 - CVSS 6.1 Medium
Cisco Nexus Dashboard Server Side Request Forgery Vulnerability
- Cisco Nexus Dashboard
- Cisco Nexus Dashboard Insights
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Server-side request forgery in Devolutions Server
- Devolutions Server
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Server-side request forgery in M-Files Corporation M-Files Server
- M-Files Corporation M-Files Server
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery
- AutohomeCorp frostmourne
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
OpenClaw affected by SSRF via unguarded image download in fal provider
- Server-side request forgery (SSRF)
<2026.3.28 · fixed in 2026.3.28
GHSA-qxgf-hmcj-3xw3 · CVE-2026-34504 - CVSS 5.1 Medium
OpenClaw SSRF guard misses four IPv6 special-use ranges
- Server-side request forgery (SSRF)
- CWE-184
<2026.3.28 · fixed in 2026.3.28
GHSA-g86v-f9qv-rh6m · CVE-2026-41361 - CVSS 5.3 Medium
Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters
- Server-side request forgery (SSRF)
<6.2.5 · fixed in 6.2.5
GHSA-pqhr-mp3f-hrpp - CVSS 10.0 CriticalCritical · CVSS 9+
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
- Server-side request forgery (SSRF)
<3.2.0 · fixed in 3.2.0
GHSA-vv7q-7jx5-f767 · CVE-2026-32871 - CVSS 6.9 Medium
FreeScout: SSRF protection bypass via broken CIDR check in checkIpByMask()
- freescout
- Server-side request forgery (SSRF)
- CVSS 7.6 High
InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field
- InvoiceShelf
- Server-side request forgery (SSRF)
- CVSS 7.6 High
InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field
- InvoiceShelf
- Server-side request forgery (SSRF)
- CVSS 7.6 High
InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field
- InvoiceShelf
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Discourse: Group SMTP test endpoint susceptible to SSRF
- discourse
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
chatwoot Webhook API trigger.rb Trigger server-side request forgery
- chatwoot
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Duplicate Advisory: OpenClaw affected by SSRF via unguarded image download in fal provider
- Server-side request forgery (SSRF)
<2026.3.28 · fixed in 2026.3.28
GHSA-35cq-wv6v-88xf - CVSS 10.0 CriticalCritical · CVSS 9+
FastGPT: Unauthenticated SSRF via httpTools Endpoint Leads to Internal API Key Theft
- labring FastGPT
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Server-Side Request Forgery via MCP Tools Endpoint in FastGPT
- labring FastGPT
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
<29.2.0 || >=30.0.0, <30.2.0 || >=31.0.0, <31.1.0 · fixed in 29.2.0, 30.2.0, 31.1.0
GHSA-mc26-q38v-83gv · CVE-2026-34881 - CVSS 5.8 Medium
Performance Monitor <= 1.0.6 - Unauthenticated Blind SSRF
- Performance Monitor
- Server-side request forgery (SSRF)
- CVSS 4.0, no score published
Duplicate Advisory: Kyverno is vulnerable to server-side request forgery (SSRF)
- Server-side request forgery (SSRF)
>=1.16.0, <=1.17.1 · no fixed version yet
GHSA-qqrv-2hch-83q4 - CVSS 4.0 Medium
Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server
- Tautulli
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SourceCodester RSS Feed Parser file_get_contents server-side request forgery
- SourceCodester RSS Feed Parser
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
- Server-side request forgery (SSRF)
<6.9.4 · fixed in 6.9.4
GHSA-3ww8-jw56-9f5h · CVE-2026-34360 - CVSS 6.8 Medium
Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
<1.1.25 · fixed in 1.1.25
GHSA-x2f5-332j-9xwq · CVE-2026-33990 - CVSS 7.8 High
Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)
- Path traversal
- Server-side request forgery (SSRF)
<=7.10.2 · no fixed version yet
GHSA-jjwv-57xh-xr6r · CVE-2026-27018 - CVSS 7.6 High
In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources.
- Command injection
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.
- Server-side request forgery (SSRF)
- CVSS 7.5 High
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` funct...
- Server-side request forgery (SSRF)
<2.1.1 · fixed in 2.1.1
PYSEC-2026-2199 · CVE-2026-0560 - CVSS 5.3 Medium
OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
- Server-side request forgery (SSRF)
<2026.3.28 · fixed in 2026.3.28
GHSA-rhfg-j8jq-7v2h · CVE-2026-35629 - CVSS 6.9 Medium
elecV2 elecV2P URL mock eAxios server-side request forgery
- elecV2P
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path
- Laborator Oxygen - WooCommerce WordPress Theme
- Server-side request forgery (SSRF)
- CVSS 8.5 High
LinkAce's SSRF protection can be bypassed via internal hostname resolution in LinkAce
- Kovah LinkAce
- Server-side request forgery (SSRF)
- CVSS 7.4 High
Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
- Server-side request forgery (SSRF)
>=3.0.0, <3.2.3 · fixed in 3.2.3
GHSA-gjxx-92w9-8v8f · CVE-2026-34076 - CVSS 7.7 High
LibreChat Server-Side Request Forgery using DNS resolution
- danny-avila LibreChat
- Server-side request forgery (SSRF)
- CVSS 8.5 High
LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP
- danny-avila LibreChat
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
letta-ai letta File URL message_helper.py _convert_message_create_to_message server-side request forgery
- letta
- Server-side request forgery (SSRF)
- CVSS 4.0, no score published
Postiz has Multiple SSRF Vectors - Webhooks, RSS Feed, URL Loader
- Server-side request forgery (SSRF)
<=2.0.12 · no fixed version yet
GHSA-89v5-38xr-9m4j - CVSS 7.5 High
Postiz App has a High-Severity SSRF Vulnerability via Next.js
- Server-side request forgery (SSRF)
- CWE-1395
<=2.0.12 · no fixed version yet
GHSA-vj2p-7pgw-g2wf - CVSS 6.9 Medium
mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery
- mingSoft MCMS
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
calibre has Server-Side Request Forgery in ebook viewer backend
- kovidgoyal calibre
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Spring AI: Insufficient Validation causes SSRF when processing multimodal messages with user-supplied URLs
- Server-side request forgery (SSRF)
>=1.0.0-M5, <1.0.5 || >=1.1.0-M1, <1.1.4 · fixed in 1.0.5, 1.1.4
GHSA-mhrg-94vw-45c5 · CVE-2026-22742