Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
router-for-me CLIProxyAPI api_tools.go server-side request forgery
- router-for-me CLIProxyAPI
- Server-side request forgery (SSRF)
- CVSS 6.0 Medium
Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services
- ellite Wallos
- Broken access control
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Incomplete fix for CVE-2026-33399: SSRF in Wallos
- ellite Wallos
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Wallos: SSRF CGNAT Bypass in subscription/payments Logo URL — is_cgnat_ip() Not Used in Inline Checks
- ellite Wallos
- Server-side request forgery (SSRF)
- CVSS 5.7 Medium
docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler
- Open redirect
- Server-side request forgery (SSRF)
<1.5.1 · fixed in 1.5.1
GHSA-fqph-j6v6-jvgx · CVE-2026-44520 - CVSS 5.9 Medium
Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme
- Path traversal
- Server-side request forgery (SSRF)
<=7.10.2 · no fixed version yet
GHSA-g924-cjx7-2rjw · CVE-2026-42597 - CVSS 9.4 CriticalCritical · CVSS 9+
Gotenberg vulnerable to unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
- Server-side request forgery (SSRF)
<8.32.0 · fixed in 8.32.0
GHSA-4vmc-gm8v-m35h · CVE-2026-42596 - CVSS 5.3 Medium
Gotenberg's DNS rebinding bypasses SSRF validation on Chromium URL conversion routes
- Race condition
- Server-side request forgery (SSRF)
<=8.31.0 · no fixed version yet
GHSA-2pmr-289p-44r3 · CVE-2026-42592 - CVSS 8.2 High
Gotenberg has a Server-Side Request Forgery (SSRF) Issue
- Server-side request forgery (SSRF)
<=8.31.0 · no fixed version yet
GHSA-rm4c-xj6x-49mw · CVE-2026-42591 - CVSS 6.6 Medium
Playwright Capture permits access to local files and internal network resources during page capture
- Server-side request forgery (SSRF)
<1.39.6 · fixed in 1.39.6
GHSA-687h-xw6f-q2qw · CVE-2026-44439 - CVSS 5.8 Medium
misp-modules has unsafe remote resource fetching in expansion
- Weak cryptography or TLS
- Server-side request forgery (SSRF)
<3.0.8 · fixed in 3.0.8
GHSA-fhq3-2gf3-8f3j · CVE-2026-44363 - CVSS 7.7 High
PraisonAI has an SSRF bypass
- Server-side request forgery (SSRF)
<1.6.32 · fixed in 1.6.32
GHSA-q9pw-vmhh-384g · CVE-2026-44335 - CVSS 5.8 Medium
Duplicate Advisory: OpenClaw: QQBot direct media upload skipped URL SSRF validation
- Server-side request forgery (SSRF)
<2026.4.20 · fixed in 2026.4.20
GHSA-r747-33r4-rmjw - CVSS 8.6 High
Duplicate Advisory: OpenClaw validates Zalo outbound photo URLs through the SSRF guard
- Server-side request forgery (SSRF)
<2026.4.22 · fixed in 2026.4.22
GHSA-qvmw-h675-h7qg - CVSS 7.1 High
QuantumNous/new-api has an SSRF Filter Bypass via 0.0.0.0
- Server-side request forgery (SSRF)
<=0.11.9-alpha.1 · no fixed version yet
GHSA-v5c3-6wvc-pc2q · CVE-2026-42339 - CVSS 6.1 Medium
Tauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands
- Server-side request forgery (SSRF)
>=2.0.0, <2.11.1 · fixed in 2.11.1
GHSA-7gmj-67g7-phm9 · CVE-2026-42184 - CVSS 7.2 High
Cisco Unity Connection Server-Side Request Forgery Vulnerability
- Cisco Unity Connection
- Server-side request forgery (SSRF)
- CVSS 7.7 High
AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()
- Server-side request forgery (SSRF)
<=29.0 · no fixed version yet
GHSA-2hch-c97c-g99x · CVE-2026-43884 - CVSS 5.4 Medium
AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
- Server-side request forgery (SSRF)
<=29.0 · no fixed version yet
GHSA-wp38-whx3-xffh · CVE-2026-43879 - CVSS 9.2 CriticalCritical · CVSS 9+
MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint
- Server-side request forgery (SSRF)
<2.36.0 · fixed in 2.36.0
GHSA-ph6f-2cvq-79hq · CVE-2026-42281 - CVSS 8.2 High
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
- Server-side request forgery (SSRF)
- CWE-20
<2.1.7 · fixed in 2.1.7
GHSA-v228-72c7-fx8j · CVE-2026-42260 - CVSS 8.2 High
ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed Inputs
- Server-side request forgery (SSRF)
- CWE-184
<=1.3.0 · no fixed version yet
GHSA-j4rj-2jr5-m439 · CVE-2026-43929 - CVSS 8.8 High
ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid
- Server-side request forgery (SSRF)
<1.2.0 · fixed in 1.2.0
GHSA-p4hc-9pjh-55c8 · CVE-2025-8267 - CVSS 8.7 High
link-preview-js vulnerable to IPv6 and internal loopback attacks
- Server-side request forgery (SSRF)
<4.0.1 · fixed in 4.0.1
GHSA-4gp8-rjrq-ch6q · CVE-2026-43897 - CVSS 6.8 Medium
Admidio has an incomplete fix for CVE-2026-32812 (SSRF)
- Server-side request forgery (SSRF)
<5.0.9 · fixed in 5.0.9
GHSA-hcjj-chvw-fmw9 · CVE-2026-42194 - CVSS 2.4 Low
Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser
- Server-side request forgery (SSRF)
<2.9.3 · fixed in 2.9.3
GHSA-xcfg-fcr5-gw9r · CVE-2026-42188 - CVSS 6.5 Medium
requests-hardened is Vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
<1.2.1 · fixed in 1.2.1
GHSA-vh75-fwv3-pqrh · CVE-2026-42175 - CVSS 4.4 Medium
XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter
- Server-side request forgery (SSRF)
<2.4.1 · fixed in 2.4.1
GHSA-42fc-7w97-8vrc · CVE-2026-42140 - CVSS 8.3 High
twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization
- twenty
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
<2.0.0-milestone-10 · fixed in 2.0.0-milestone-10
GHSA-gx3v-wxfj-8h24 · CVE-2026-7412 - CVSS 9.9 CriticalCritical · CVSS 9+
FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft
- Authentication bypass
- Server-side request forgery (SSRF)
<0.0.54 · fixed in 0.0.54
GHSA-fqvv-jvhr-g5jc · CVE-2026-42864 - CVSS 8.5 High
edx-enterprise has SSRF via SAML metadata URL in sync_provider_data endpoint
- Server-side request forgery (SSRF)
>=7.0.2, <7.0.5 · fixed in 7.0.5
GHSA-64cv-vxpr-j6vc · CVE-2026-42860 - CVSS 6.4 Medium
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'
- jegstudio Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Axios: no_proxy bypass via IP alias allows SSRF
- Server-side request forgery (SSRF)
<0.31.1 || >=1.0.0, <1.15.1 · fixed in 0.31.1, 1.15.1
GHSA-m7pr-hjqh-92cm · CVE-2026-42038 - CVSS 7.2 High
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
- Server-side request forgery (SSRF)
- CWE-183
<0.31.1 || >=1.0.0, <1.15.1 · fixed in 0.31.1, 1.15.1
GHSA-pmwg-cvhr-8vh7 · CVE-2026-42043 - CVSS 8.3 High
pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy via unrestricted `proxy.*` config (incomplete fix for CVE-2026-33509 / -35463 / -35464 / -35586)
- Broken access control
- Server-side request forgery (SSRF)
<0.5.0b3.dev100 · fixed in 0.5.0b3.dev100
GHSA-pg67-9wjv-mr85 · CVE-2026-42313 - CVSS 6.9 Medium
OpenClaw validates Zalo outbound photo URLs through the SSRF guard
- Server-side request forgery (SSRF)
<2026.4.22 · fixed in 2026.4.22
GHSA-2hh7-c75g-qj2r · CVE-2026-44116 - CVSS 5.3 Medium
Incus has Blind SSRF via Image Import Preflight HEAD
- Server-side request forgery (SSRF)
<7.0.0 · fixed in 7.0.0
GHSA-8gw4-p4wq-4hcv · CVE-2026-35527 - CVSS 5.3 Medium
pixelsock directus-mcp MCP index.ts validateUrl server-side request forgery
- pixelsock directus-mcp
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter
- wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
JeecgBoot uploadImgByHttpEndpoint CommonController.java HttpFileToMultipartFileUtil.downloadImageData server-side request forgery
- JeecgBoot
- Server-side request forgery (SSRF)
- CVSS 7.2 High
PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter
- PixelYourSite Pro – Your smart PIXEL (TAG) Manager
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter
- deothemes Ona
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
JeecgBoot OpenApi Service OpenApiController.java OpenApiController.call server-side request forgery
- JeecgBoot
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
JeecgBoot LoadFile Endpoint FileDownloadUtils.jav checkPathTraversalBatch server-side request forgery
- JeecgBoot
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Apache Neethi doesn't impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API
- Server-side request forgery (SSRF)
<3.2.2 · fixed in 3.2.2
GHSA-287c-fxr7-3w6c · CVE-2026-42404 - CVSS 6.5 Medium
Server-Side Request Forgery (SSRF) in Langflow URL Component
- IBM Langflow Desktop
- Server-side request forgery (SSRF)
- CVSS 8.5 High
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
- Server-side request forgery (SSRF)
>=2.47.4, <2.47.14 · fixed in 2.47.14
GHSA-56c3-vfp2-5qqj · CVE-2026-42449 - CVSS 5.3 Medium
Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url
- Server-side request forgery (SSRF)
- CWE-20
<5.17.1 · fixed in 5.17.1
GHSA-cwcx-382v-8m9g · CVE-2026-41654 - CVSS 6.9 Medium
Gotenberg Vulnerable to Unauthenticated SSRF via Unfiltered Webhook URL
- Server-side request forgery (SSRF)
>=8.29.1, <8.31.0 · fixed in 8.31.0
GHSA-5vh4-rgv7-p9g4 · CVE-2026-39383 - CVSS 7.8 High
Gotenberg has case-insensitive URL scheme that bypasses webhook and downloadFrom deny-list SSRF protection
- Server-side request forgery (SSRF)
<8.31.0 · fixed in 8.31.0
GHSA-5q7p-7jgv-ww56 · CVE-2026-40280 - CVSS 5.0 Medium
A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers to scan internal resources via a crafted GET request.
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
- Server-side request forgery (SSRF)
- CVSS 8.2 High
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
- Path traversal
- Server-side request forgery (SSRF)
<3.9.3 · fixed in 3.9.3
GHSA-jfgf-83c5-2c4m · CVE-2026-42353 - CVSS 8.6 High
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
- Server-side request forgery (SSRF)
>=0.23.0, <0.23.3 · fixed in 0.23.3
GHSA-jgvc-94c8-3chc · CVE-2026-42352 - CVSS 6.9 Medium
Algovate xhs-mcp MCP mcp.server.ts xhs_publish_content server-side request forgery
- Algovate xhs-mcp
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Nginx-UI has Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware that Allows Access to Internal Services
- Server-side request forgery (SSRF)
<=2.3.4 · no fixed version yet
GHSA-wr32-99hh-6f35 · CVE-2026-44015