Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.2 CriticalCritical · CVSS 9+
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
- Insecure deserialization
- Server-side request forgery (SSRF)
<1.30.3 || >=2.0.0, <2.1.15 || >=2.2.0, <2.4.4 || >=3.3.0, <3.10.4 || >=4.0.0, <5.6.0 · fixed in 1.30.3, 2.1.15, 2.4.4, 3.10.4, 5.6.0
GHSA-q4q6-r8wh-5cgh · CVE-2026-34084 - CVSS 5.4 Medium
WordPress Share This Image plugin <= 2.14 - Server Side Request Forgery (SSRF) vulnerability
- ILLID Share This Image
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Server-side request forgery in Dell Disk Library for mainframe DLm8700 and others
- Dell Disk Library for mainframe DLm8700
- Dell Disk Library for mainframe DLm2700
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Xuxueli xxl-job trigger Endpoint XxlJobServiceImpl.java triggerJob server-side request forgery
- Xuxueli xxl-job
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Server-side request forgery in NVIDIA NemoClaw
- NVIDIA NemoClaw
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
o2oa URL Fetching FileAction.java FileAction server-side request forgery
- o2oa
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue
- Server-side request forgery (SSRF)
<=2.0.0-alpha.63 · no fixed version yet
GHSA-r2jq-4h3x-rfj6 · CVE-2026-7223 - CVSS 6.9 Medium
TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery
- TencentCloudBase CloudBase-MCP
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery
- ChatGPTNextWeb NextChat
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery
- ChatGPTNextWeb NextChat
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
mcp-url-downloader has a Server-Side Request Forgery issue
- Server-side request forgery (SSRF)
<=0.1.0 · no fixed version yet
GHSA-h7xc-4mv8-59fj · CVE-2026-7158 - CVSS 5.3 Medium
auto-favicon has a Server-Side Request Forgery issue
- Server-side request forgery (SSRF)
<=1.0.1 · no fixed version yet
GHSA-vmh7-9c7h-2pgg · CVE-2026-7150 - CVSS 6.9 Medium
JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery
- JoeCastrom mcp-chat-studio
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery
- AlejandroArciniegas mcp-data-vis
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
ShadowCloneLabs GlutamateMCPServers puppeteer_navigate index.ts server-side request forgery
- ShadowCloneLabs GlutamateMCPServers
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
HBAI-Ltd Toonflow-app getCodeByLink Endpoint getCodeByLink.ts fetch server-side request forgery
- HBAI-Ltd Toonflow-app
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
BidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgery
- BidingCC BuildingAI
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery
- Typecho
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks
- Server-side request forgery (SSRF)
<2026.4.20 · fixed in 2026.4.20
GHSA-j4c5-89f5-f3pm · CVE-2026-45000 - CVSS 6.3 Medium
OpenClaw: QQBot direct media upload skipped URL SSRF validation
- Server-side request forgery (SSRF)
<2026.4.20 · fixed in 2026.4.20
GHSA-c4qg-j8jg-42q5 · CVE-2026-44117 - CVSS 5.1 Medium
pagekit download server-side request forgery
- pagekit
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
IhateCreatingUserNames2 AiraHub2 Endpoint AiraHub.py sync_agents server-side request forgery
- IhateCreatingUserNames2 AiraHub2
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
devlikeapro WAHA API Request media.controller.ts server-side request forgery
- devlikeapro WAHA
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Lemmy has SSRF in /api/v3/post via Webmention dispatch
- Server-side request forgery (SSRF)
<0.19.18 · fixed in 0.19.18
GHSA-3jvj-v6w2-h948 · CVE-2026-42180 - CVSS 6.5 Medium
Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image
- Server-side request forgery (SSRF)
<0.19.18 · fixed in 0.19.18
GHSA-h6hf-9846-xwrq · CVE-2026-42181 - CVSS 4.9 Medium
Xibo CMS has Authenticated Server-Side Request Forgery (SSRF) in Remote DataSet Functionality
- xibosignage xibo-cms
- Server-side request forgery (SSRF)
- CVSS 2.2 Low
Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)
- Server-side request forgery (SSRF)
<13.1.10 · fixed in 13.1.10
GHSA-88gm-j2wx-58h6 · CVE-2026-41321 - CVSS 10.0 CriticalCritical · CVSS 9+
Microsoft Entra ID Entitlement Management Spoofing Vulnerability
- Microsoft Entra
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Microsoft Purview eDiscovery Elevation of Privilege Vulnerability
- Microsoft Purview eDiscovery
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Microsoft Dynamics 365 (online) Spoofing Vulnerability
- Microsoft Dynamics 365 (online)
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
SocialEngine <= 7.8.0 Blind SSRF via /core/link/preview
- SocialEngine
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction
- squidex
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 7.3 High
Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)
- squidex
- Server-side request forgery (SSRF)
- CVSS 7.3 High
SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient
- squidex
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests
- squidex
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
WeKan < 8.35 SSRF via Webhook URL
- wekan
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)
- Path traversal
- Server-side request forgery (SSRF)
<1.8.16 || >=2.0.0-beta.1, <2.0.0-rc.1 · fixed in 1.8.16, 2.0.0-rc.1
GHSA-xjvc-pw2r-6878 · CVE-2026-41887 - CVSS 8.3 High
monetr: Server-side request forgery in Lunch Flow link creation and refresh
- Information disclosure
- Denial of service
<1.12.5 · fixed in 1.12.5
GHSA-29v9-frvh-c426 · CVE-2026-41644 - CVSS 8.5 High
An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0).
- Server-side request forgery (SSRF)
- CVSS 8.9 High
Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack
- GitHub Enterprise Server
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Bagisto affected by Server-Side Request Forgery
- Server-side request forgery (SSRF)
<=2.3.15 · no fixed version yet
GHSA-x3f9-vcp2-hgcw · CVE-2026-6744 - CVSS 4.1 Medium
FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints
- freescout
- Server-side request forgery (SSRF)
- CVSS 7.3 High
Glances has SSRF in IP Plugin via public_api leading to credential leakage
- Server-side request forgery (SSRF)
<4.5.4 · fixed in 4.5.4
GHSA-g5pq-48mj-jvw8 · CVE-2026-35587 - CVSS 7.5 HighCritical · CVSS 7+ and EPSS
LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
- Server-side request forgery (SSRF)
<=0.12.2 · no fixed version yet
GHSA-6w67-hwm5-92mq · CVE-2026-33626 - CVSS 5.8 Medium
Vexa Webhook Feature has a SSRF Vulnerability
- vexa
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Vvveb < 1.0.8.1 SSRF via oEmbedProxy
- givanz Vvveb
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Qibo CMS headers server-side request forgery
- Qibo CMS
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery
- moxi624 Mogu Blog v2
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
langgenius dify ApiBasedToolSchemaParser parser.py parse_openai_plugin_json_to_tool_bundle server-side request forgery
- langgenius dify
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
langgenius dify ApiToolManageService api_tools_manage_service.py get_api_tool_provider_remote_schema server-side request forgery
- langgenius dify
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery
- TransformerOptimus SuperAGI
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
AgentScope vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
<=1.0.18 · no fixed version yet
GHSA-crx8-wpv6-jrj2 · CVE-2026-6606 - CVSS 6.9 Medium
AgentScope vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
<=1.0.18 · no fixed version yet
GHSA-8ggf-r3vm-p3jc · CVE-2026-6605 - CVSS 6.9 Medium
AgentScope vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
<=1.0.18 · no fixed version yet
GHSA-659x-hm75-hpv7 · CVE-2026-6604 - CVSS 5.3 Medium
RAGAS has SSRF via Multi-Modal Faithfulness Collections Module
- Server-side request forgery (SSRF)
>=0.2.3, <=0.4.3 · no fixed version yet
GHSA-95ww-475f-pr4f · CVE-2026-6587 - CVSS 5.3 Medium
PHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery
- PHPEMS
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing
- leepeuker movary
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets
- Open redirect
- Server-side request forgery (SSRF)
<2026.4.5 · fixed in 2026.4.5
GHSA-f7fh-qg34-x2xh · CVE-2026-43576 - CVSS 4.9 Medium
OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage
- Broken access control
- Server-side request forgery (SSRF)
<2026.4.10 · fixed in 2026.4.10
GHSA-536q-mj95-h29h · CVE-2026-43580 - CVSS 4.9 Medium
OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement
- Broken access control
- Server-side request forgery (SSRF)
<2026.4.10 · fixed in 2026.4.10
GHSA-527m-976r-jf79 · CVE-2026-43573