Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.7 High
Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access
- Elastic Kibana
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
local-deep-research has an SSRF bypass in `safe_get`
- Server-side request forgery (SSRF)
<1.6.10 · fixed in 1.6.10
GHSA-g23j-2vwm-5c25 · CVE-2026-46526 - CVSS 6.9 Medium
Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin
- MusicPlayerDaemon MPD
- Server-side request forgery (SSRF)
- CVSS 6.7 Medium
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
- Server-side request forgery (SSRF)
<3.12.2 || >=4.0.0, <4.0.3 · fixed in 3.12.2, 4.0.3
GHSA-w76h-q7c6-jpjp · CVE-2026-46380 - CVSS 6.2 Medium
FlowIntel external reference URL probe allows server-side request forgery
- flowintel
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route
- bensibley Independent Analytics – WordPress Analytics Plugin
- Server-side request forgery (SSRF)
- CVSS 6.6 Medium
Jenkins Active Directory Plugin follows LDAP referrals by default
- Server-side request forgery (SSRF)
<2.41.1 · fixed in 2.41.1
GHSA-wrhr-54p6-q97f · CVE-2026-48918 - CVSS 6.6 Medium
Jenkins LDAP Plugin follows LDAP referrals
- Server-side request forgery (SSRF)
<807.809.vd3a · fixed in 807.809.vd3a
GHSA-fmjp-mw89-c6h6 · CVE-2026-48916 - CVSS 9.2 CriticalCritical · CVSS 9+
Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed access to internal services via path traversal in upload endpoint
- GitHub Enterprise Server
- Server-side request forgery (SSRF)
- CVSS 7.0 High
Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint
- GitHub Enterprise Server
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch
- 1Panel-dev MaxKB
- Race condition
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
MaxKB: Unauthenticated SSRF via Workflow Template Import
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Weblate has a Server-Side Request Forgery issue
- Cross-site request forgery (CSRF)
- Server-side request forgery (SSRF)
<5.15 · fixed in 5.15
GHSA-hfpv-mc5v-p9mm · CVE-2025-66407 - CVSS 9.2 CriticalCritical · CVSS 9+
Server-Side Request Forgery and Credential Exfiltration in Google Cloud Apigee via SetIntegrationRequest Policy.
- Google Cloud Apigee-X
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
IBM webMethods Integration Sever is vulnerable to server-side request forgery
- IBM webMethods Integration (on prem) -Integration Server
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
e107: Server-Side Request Forgery (SSRF) in the remote file fetcher
- e107
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator
- Apache Software Foundation Apache Flink Kubernetes Operator
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Karakeep has a SSRF Protection Bypass via Redirect Handling
- karakeep
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Apache Shiro Vulnerable to Open Redirect, Server-Side Request Forgery
- Open redirect
- Server-side request forgery (SSRF)
>=2.0.0-alpha-0, <2.2.0 || >=3.0.0-alpha-1, <3.0.0-alpha-2 · fixed in 2.2.0, 3.0.0-alpha-2
GHSA-wpqm-4gwx-w843 · CVE-2026-44598 - CVSS 7.2 High
Server-side request forgery in Roundcube Webmail
- Roundcube Webmail
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
SSRF allowlist bypass via percent-encoded host in hackney
- Server-side request forgery (SSRF)
- CWE-436
>=0.13.0, <4.0.1 · fixed in 4.0.1
GHSA-pj7v-xfvx-wmjq · CVE-2026-47076 - CVSS 5.1 Medium
YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery
- YunaiV yudao-cloud
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
ItzCrazyKns Vane Model Provider API route.ts server-side request forgery
- ItzCrazyKns Vane
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery
- calcom cal.diy
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
instagrapi: Unsafe signup challenge path handling in instagrapi
- Server-side request forgery (SSRF)
<2.6.9 · fixed in 2.6.9
GHSA-ggxf-37hm-9wqf - CVSS 6.5 Medium
aiograpi: Unsafe signup challenge path handling
- Server-side request forgery (SSRF)
<0.9.10 · fixed in 0.9.10
GHSA-jh37-x3fv-4x72 · CVE-2026-47157 - CVSS 7.7 High
Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification
- Broken access control
- Server-side request forgery (SSRF)
>=1.4.0, <1.14.15-0.20260517022419-d06d539d34c1 · fixed in 1.14.15-0.20260517022419-d06d539d34c1
GHSA-w4g9-mxgg-j532 · CVE-2026-46717 - CVSS 7.7 High
TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks
- baptisteArno typebot.io
- Server-side request forgery (SSRF)
- CVSS 7.6 High
TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation
- baptisteArno typebot.io
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 10.0 CriticalCritical · CVSS 9+
TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls
- baptisteArno typebot.io
- Broken access control
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Server-side request forgery in Devolutions Server
- Devolutions Server
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter
- techjewel FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
- Server-side request forgery (SSRF)
- CVSS 2.1 Low
Concrete CMS's RSS Displayer block accepts a feed URL from any page editor and fetches it server-side without validation
- Server-side request forgery (SSRF)
<9.5.1 · fixed in 9.5.1
GHSA-gjwq-9v8p-47w7 · CVE-2026-7890 - CVSS 6.8 Medium
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)
- Server-side request forgery (SSRF)
>=1.56.0, <1.99.0 · fixed in 1.99.0
GHSA-cqp8-fcvh-x7r3 · CVE-2026-46678 - CVSS 6.5 Medium
FlaskBB: SSRF in get_image_info() via unrestricted avatar URL
- Server-side request forgery (SSRF)
<=2.2.0 · no fixed version yet
GHSA-xq32-9g7q-7297 · CVE-2026-46556 - CVSS 4.3 Medium
NocoDB: SSRF Protection Bypass in Notification Webhook Plugins (Slack, Discord, Mattermost, Teams)
- Server-side request forgery (SSRF)
<=0.301.3 · no fixed version yet
GHSA-2c5x-4jgf-88mj · CVE-2026-46548 - CVSS 6.9 Medium
Snappy : SSRF and local file read via the xsl-style-sheet option
- Server-side request forgery (SSRF)
<1.7.0 · fixed in 1.7.0
GHSA-c5fp-p67m-gq56 · CVE-2026-46683 - CVSS 5.0 Medium
pyload-ng: SSRF via HTTP Redirect Bypass in parse_urls API
- Server-side request forgery (SSRF)
<0.5.0b3.dev100 · fixed in 0.5.0b3.dev100
GHSA-8rp3-xc6w-5qp5 · CVE-2026-46561 - CVSS 2.3 Low
Crawlee for Python: SSRF via sitemap-derived URLs
- Server-side request forgery (SSRF)
>=1.0.0, <1.7.0 · fixed in 1.7.0
GHSA-3r75-xc34-5f44 · CVE-2026-46497 - CVSS 5.4 Medium
Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter
- wpdive Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- Server-side request forgery (SSRF)
- CVSS 8.8 High
@angular/platform-server: SSRF via Hostname Hijacking
- Server-side request forgery (SSRF)
<=18.2.14 || >=19.0.0-next.0, <19.2.22 || >=20.0.0-next.0, <20.3.21 || >=21.0.0-next.0, <21.2.13 || >=22.0.0-next.0, <22.0.0-next.12 · fixed in 19.2.22, 20.3.21, 21.2.13, 22.0.0-next.12
GHSA-rfh7-fxqc-q52v · CVE-2026-46417 - CVSS 8.5 High
SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl
- Server-side request forgery (SSRF)
<1.18.0 · fixed in 1.18.0
GHSA-qg89-qwwh-5f3j · CVE-2026-46372 - CVSS 6.5 Medium
Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint
- Server-side request forgery (SSRF)
<=0.27.3 · no fixed version yet
GHSA-686c-7vgv-v3fx · CVE-2026-45796 - CVSS 5.3 Medium
n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass
- Server-side request forgery (SSRF)
<2.20.0 · fixed in 2.20.0
GHSA-3875-8gcx-7v46 · CVE-2026-56348 - CVSS 9.3 CriticalCritical · CVSS 9+
Server-side request forgery in tenable Terrascan
- tenable Terrascan
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Server-side request forgery in tenable Terrascan
- tenable Terrascan
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Server-side request forgery in tenable Terrascan
- tenable Terrascan
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer
- Server-side request forgery (SSRF)
>=1.28.3, <1.30.0 · fixed in 1.30.0
GHSA-j3fj-qppj-fmmc · CVE-2026-45709 - CVSS 8.2 High
auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs
- Server-side request forgery (SSRF)
<3.0.1 · fixed in 3.0.1
GHSA-hv85-774v-26fg - CVSS 8.7 High
HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis
- Server-side request forgery (SSRF)
- CWE-183
<26.0.0 · fixed in 26.0.0
GHSA-4fg7-f244-3j49 · CVE-2026-46391 - CVSS 7.1 High
HAXcms createSite SSRF Enables Arbitrary File Read
- Server-side request forgery (SSRF)
<26.0.0 · fixed in 26.0.0
GHSA-q862-gcgq-5m6g · CVE-2026-46393 - CVSS 7.5 High
Apache OFBiz: Improper Input Validation in UI Factory Classes Leads to SSRF and Blind File Access
- Apache Software Foundation Apache OFBiz
- Server-side request forgery (SSRF)
- CVSS 7.3 High
Apache OFBiz: Low-Privilege SSRF in Content Component
- Apache Software Foundation Apache OFBiz
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar_url query parameter of the Scalar Proxy endpoint.
- Server-side request forgery (SSRF)
- CVSS 4.6 Medium
Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links
- Server-side request forgery (SSRF)
- CWE-940
<0.15.1 · fixed in 0.15.1
GHSA-2r69-qgv3-hr65 · CVE-2026-45245 - CVSS 8.6 High
Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)
- Server-side request forgery (SSRF)
<=8.14.12 · no fixed version yet
GHSA-3v9w-6365-9w54 · CVE-2026-45298 - CVSS 5.4 Medium
Statamic CMS: Server-Side Request Forgery via Glide
- Server-side request forgery (SSRF)
<5.73.22 || >=6.0.0-alpha.1, <6.18.1 · fixed in 5.73.22, 6.18.1
GHSA-pf9c-ch8r-2958 · CVE-2026-45660 - CVSS 0.0 None
Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping
- Server-side request forgery (SSRF)
>=2.0.0, <2.14.2 · fixed in 2.14.2
GHSA-5rv5-xj5j-3484 · CVE-2026-33637