Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.8 Medium
Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms
- Server-side request forgery (SSRF)
<1.30.2 · fixed in 1.30.2
GHSA-w4mc-hhc6-xp28 · CVE-2026-55187 - CVSS 6.9 Medium
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
>=4.0.0-RC1, <4.18 || >=5.0.0-RC1, <5.10 · fixed in 4.18, 5.10
GHSA-c55v-343g-5xff · CVE-2026-55791 - CVSS 5.3 Medium
Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)
- sourcentis mercator
- Server-side request forgery (SSRF)
- CVSS 4.6 Medium
Hugo: security.http.urls deny rules bypassed by alternate IPv4 encodings (SSRF)
- Server-side request forgery (SSRF)
>=0.162.0, <0.163.1 · fixed in 0.163.1
GHSA-r46f-3rpw-hxrv · CVE-2026-58404 - CVSS 6.3 Medium
Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential
- Red Hat Ansible Automation Platform 2
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)
- Broken access control
- Server-side request forgery (SSRF)
>=1.1.0, <3.0.4 · fixed in 3.0.4
GHSA-xm3x-9cfw-jhx4 · CVE-2026-55414 - CVSS 4.8 Medium
canto-saas-api: Authenticated API requests can be redirected via unencoded path variables
- Other injection
- Server-side request forgery (SSRF)
<3.0.0 · fixed in 3.0.0
GHSA-9qfv-wgh2-m6p8 · CVE-2026-55374 - CVSS 6.5 Medium
Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping
- bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter
- addonspress Advanced Import
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints
- Server-side request forgery (SSRF)
<2.28.0 · fixed in 2.28.0
GHSA-q59x-jc9f-gfqf · CVE-2026-55591 - CVSS 6.0 Medium
OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently
- Server-side request forgery (SSRF)
- CWE-20
<2026.5.26 · fixed in 2026.5.26
GHSA-gxg4-2rrr-jhc7 · CVE-2026-53859 - CVSS 8.6 High
Crawl4AI: Unauthenticated SSRF on the Docker server streaming crawl path (/crawl/stream)
- Server-side request forgery (SSRF)
<0.9.0 · fixed in 0.9.0
GHSA-wm69-2pc3-rmmf · CVE-2026-57573 - CVSS 3.1 Low
BBOT: Server-Side Request Forgery (SSRF) in docker_pull module via WWW-Authenticate realm parsing
- Server-side request forgery (SSRF)
- CWE-20
>=2.0.0, <2.8.5 · fixed in 2.8.5
GHSA-3mp7-vp6j-2mxx · CVE-2026-12566 - CVSS 7.1 High
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message
- Path traversal
- Server-side request forgery (SSRF)
<9.0.1 · fixed in 9.0.1
GHSA-p6gq-j5cr-w38f · CVE-2026-82659 - CVSS 8.8 High
PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
- Server-side request forgery (SSRF)
- CWE-20
<1.6.61 · fixed in 1.6.61
GHSA-4pcv-mg8v-vrgf · CVE-2026-57143 - CVSS 7.2 High
PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
- Race condition
- Server-side request forgery (SSRF)
>=4.5.126, <4.6.59 · fixed in 4.6.59
GHSA-rjvw-7vvw-549v · CVE-2026-57114 - CVSS 8.5 High
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
- Server-side request forgery (SSRF)
<1.6.59 · fixed in 1.6.59
GHSA-vxgj-xg5c-p4h7 · CVE-2026-57126 - CVSS 6.5 Medium
PraisonAI: SpiderTools redirect-target SSRF protection bypass
- Server-side request forgery (SSRF)
<1.6.59 · fixed in 1.6.59
GHSA-6h9p-93hq-q7h6 · CVE-2026-57115 - CVSS 7.5 High
Gotenberg: SSRF via LibreOffice document processing
- Server-side request forgery (SSRF)
<8.34.0 · fixed in 8.34.0
GHSA-2mrg-35hw-x3x9 · CVE-2026-55229 - CVSS 2.3 Low
ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components
- Server-side request forgery (SSRF)
<1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2 · fixed in 1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2
GHSA-29jh-8cfq-rr8x · CVE-2026-55671 - CVSS 7.2 High
CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host
- mariovalney CF7 to Webhook
- Server-side request forgery (SSRF)
- CVSS 8.2 High
TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass
- baptisteArno typebot.io
- Server-side request forgery (SSRF)
- CVSS 3.1 Low
The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via `providers.json` and via URL discovery.
- Server-side request forgery (SSRF)
<10.5.12 || >=10.6.0, <10.6.11 || >=11.0.0, <11.1.0 || >=11.1.0, <11.2.0 || >=11.2.0, <11.2.14 || >=11.3.0, <11.3.12 · fixed in 10.5.12, 10.6.11, 11.1.0, 11.2.0, 11.2.14, 11.3.12
DRUPAL-CORE-2026-008 · CVE-2026-55807 - CVSS 7.7 High
Open WebUI: SSRF Protection Bypass in Playwright Web Loader via HTTP Redirects
- Server-side request forgery (SSRF)
<0.9.6 · fixed in 0.9.6
GHSA-jrfp-m64g-pcwv · CVE-2026-54018 - CVSS 7.7 High
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
- Path traversal
- Server-side request forgery (SSRF)
<0.9.6 · fixed in 0.9.6
GHSA-r2wg-2mcr-66rv · CVE-2026-54017 - CVSS 8.5 High
Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling of CVE-2026-45401)
- Server-side request forgery (SSRF)
<0.9.6 · fixed in 0.9.6
GHSA-226f-f24g-524w · CVE-2026-54008 - CVSS 6.9 Medium
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint
- Server-side request forgery (SSRF)
- CWE-441
<=0.301.3 · no fixed version yet
GHSA-hmcr-rmjq-47qr · CVE-2026-53931 - CVSS 5.1 Medium
NocoDB: Server-Side Request Forgery via Base Migration URL
- Server-side request forgery (SSRF)
<=0.301.3 · no fixed version yet
GHSA-h6vv-pcq8-7xm4 · CVE-2026-53930 - CVSS 5.1 Medium
NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL
- Server-side request forgery (SSRF)
<=0.301.3 · no fixed version yet
GHSA-gprh-27j3-g5h4 · CVE-2026-53927 - CVSS 6.5 Medium
Duplicate Advisory: Hostname checks could treat trailing-dot hosts inconsistently
- Server-side request forgery (SSRF)
<=2026.5.22 · no fixed version yet
GHSA-vqx6-6j84-2794 - CVSS 8.6 High
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
- Server-side request forgery (SSRF)
<0.8.9 · fixed in 0.8.9
GHSA-6qhc-x826-342c · CVE-2026-53755 - CVSS 8.8 High
Crawl4AI: LLM credential exfiltration in Docker server via request base_url and env: token resolution
- Information disclosure
- Hard-coded credentials
<0.8.8 · fixed in 0.8.8
GHSA-f989-c77f-r2cq · CVE-2026-56259 - CVSS 7.5 High
Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped)
- Server-side request forgery (SSRF)
<0.8.8 · fixed in 0.8.8
GHSA-4qqr-vv2q-cmr5 · CVE-2026-53754 - CVSS 9.0 CriticalCritical · CVSS 9+
LobeHub: Unauthenticated SSRF in `/webapi/proxy`
- Server-side request forgery (SSRF)
<2.1.57 · fixed in 2.1.57
GHSA-xmwj-c75x-6346 · CVE-2026-54157 - CVSS 8.8 High
Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution
- Path traversal
- Cross-site scripting (XSS)
<0.8.7 · fixed in 0.8.7
GHSA-365w-hqf6-vxfg · CVE-2026-56260 - CVSS 6.3 Medium
Hugo: security.http.urls allow-list bypass via HTTP redirects
- Server-side request forgery (SSRF)
>=0.91.0, <0.162.0 · fixed in 0.162.0
GHSA-vxgm-5rmg-5w8g · CVE-2026-50134 - CVSS 5.2 Medium
Deno: WebSocket API sandbox bypass via missing post-DNS check
- Server-side request forgery (SSRF)
<2.8.1 · fixed in 2.8.1
GHSA-83pc-3rw9-qpwj · CVE-2026-49860 - CVSS 5.2 Medium
Deno: `fetch()` API sandbox bypass via missing DNS resolution check
- Server-side request forgery (SSRF)
- CWE-693
<2.8.1 · fixed in 2.8.1
GHSA-cpgj-f7g3-2pp2 · CVE-2026-49859 - CVSS 5.8 Medium
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
- Server-side request forgery (SSRF)
>=0.1.1, <1.0.30 || >=2.0.0, <2.0.55 || >=3.0.0, <3.0.54 · fixed in 1.0.30, 2.0.55, 3.0.54
GHSA-m557-wrgg-6rp4 · CVE-2026-55599 - CVSS 7.5 High
Astro: Host header SSRF in prerendered error page fetch
- Server-side request forgery (SSRF)
- CWE-20
<6.4.6 · fixed in 6.4.6
GHSA-2pvr-wf23-7pc7 · CVE-2026-54299 - CVSS 5.3 Medium
@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config
- Server-side request forgery (SSRF)
<7.0.13 · fixed in 7.0.13
GHSA-529g-xq4f-cw38 · CVE-2026-54300 - CVSS 9.1 CriticalCritical · CVSS 9+
shlink has a Server-Side Request Forgery issue
- Server-side request forgery (SSRF)
<=5.0.1 · no fixed version yet
GHSA-p85r-x2wj-mxqj · CVE-2026-50887 - CVSS 8.1 High
Koillection has an authenticated Server-Side Request Forgery issue
- Server-side request forgery (SSRF)
<1.8.4 · fixed in 1.8.4
GHSA-gmxh-hjfv-qc2w · CVE-2026-50888 - CVSS 4.4 Medium
WordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability
- vynnus PopAd
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
- Server-side request forgery (SSRF)
<1.1.0 · fixed in 1.1.0
GHSA-wqp7-x3pw-xc5r · CVE-2026-48818 - CVSS 4.2 Medium
PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes
- Server-side request forgery (SSRF)
- CWE-441
>=2.0.0, <2.13.0 · fixed in 2.13.0
GHSA-993g-76c3-p5m4 · CVE-2026-48522 - CVSS 6.9 Medium
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
- Server-side request forgery (SSRF)
- CWE-184
>=5.4.0, <5.4.53 · fixed in 5.4.53
GHSA-38cx-cq6f-5755 · CVE-2026-48736 - CVSS 8.8 High
@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass
- Server-side request forgery (SSRF)
- CWE-346
<=18.2.14 || >=19.0.0-next.0, <19.2.23 || >=20.0.0-next.0, <20.3.22 || >=21.0.0-next.0, <21.2.15 || >=22.0.0-next.0, <22.0.0-rc.2 · fixed in 19.2.23, 20.3.22, 21.2.15, 22.0.0-rc.2
GHSA-xrxm-cp7j-8xf6 · CVE-2026-50168 - CVSS 6.3 Medium
Duplicate Advisory: utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
- Server-side request forgery (SSRF)
<=1.1.0 · no fixed version yet
GHSA-vg9f-q4xh-62r4 - CVSS 5.3 Medium
Budibase: Unvalidated VectorDB Host Parameter Enables SSRF
- Server-side request forgery (SSRF)
<3.35.3 · fixed in 3.35.3
GHSA-cv96-5348-p5p8 · CVE-2026-48148 - CVSS 6.5 Medium
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
- XML external entities (XXE)
- Server-side request forgery (SSRF)
<2.26.4 || >=2.27.0, <2.27.3 · fixed in 2.26.4, 2.27.3
GHSA-x4r9-gmw3-hxww · CVE-2025-58175 - CVSS 7.7 High
Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection
- Server-side request forgery (SSRF)
<3.39.0 · fixed in 3.39.0
GHSA-g6qx-g4pr-92v7 · CVE-2026-48146 - CVSS 5.1 Medium
Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
- Server-side request forgery (SSRF)
<3.39.0 · fixed in 3.39.0
GHSA-6964-pp88-6wp9 · CVE-2026-48128 - CVSS 6.3 Medium
@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch
- Server-side request forgery (SSRF)
<0.17.0 · fixed in 0.17.0
GHSA-3vx2-vqx8-jxfg · CVE-2026-53782 - CVSS 7.7 High
Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint
- garlic-signage garlic-hub
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Fediverse Embeds: Unauthenticated SSRF / open proxy via REST media-proxy endpoint
- stefanbohacek fediverse-embeds-wordpress-plugin
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Fediverse Embeds: Public-nonce SSRF via ftf_get_site_info AJAX action
- stefanbohacek fediverse-embeds-wordpress-plugin
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset
- Server-side request forgery (SSRF)
<0.19.4 · fixed in 0.19.4
GHSA-4mj9-pf4r-cqrc · CVE-2026-48053 - CVSS 5.4 Medium
IBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services
- IBM Langflow Desktop
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
guzzlehttp/psr7 has Host Confusion via Authority Reinterpretation
- Server-side request forgery (SSRF)
- CWE-20
<2.10.2 · fixed in 2.10.2
GHSA-34xg-wgjx-8xph · CVE-2026-48998