Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations
- Server-side request forgery (SSRF)
>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8 · fixed in 5.0.2, 4.1.4
GHSA-whpp-xv3h-rwxf · CVE-2026-40999 - CVSS 7.6 High
Server-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise
- Splunk Enterprise
- Splunk Cloud Platform
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks
- Erlang OTP
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Roxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPs
- roxy-wi
- Server-side request forgery (SSRF)
- CVSS 3.5 Low
Papra HTTP redirect bypass can lead to SSRF via webhook delivery system
- Server-side request forgery (SSRF)
<0.3.3 · fixed in 0.3.3
GHSA-5g86-85rp-f9hx · CVE-2026-48051 - CVSS 10.0 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Campaign Classic
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Microsoft Exchange Server Elevation of Privilege Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Microsoft Exchange Server Information Disclosure Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Microsoft Exchange Server Spoofing Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Server-side request forgery (SSRF)
- CVSS 4.2 Medium
Spring Framework Server-Side Request Forgery via UriComponentsBuilder
- Server-side request forgery (SSRF)
>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 · fixed in 7.0.8, 6.2.19
GHSA-7m2p-62gw-p8qq · CVE-2026-41854 - CVSS 7.1 High
Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks
- Path traversal
- Information disclosure
<0.0.0-20260520141557-91bdc29d1a02 · fixed in 0.0.0-20260520141557-91bdc29d1a02
GHSA-p2j4-c4g6-rpf5 · CVE-2026-47735 - CVSS 8.2 High
FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
- Server-side request forgery (SSRF)
<=1.1.14-1243 · no fixed version yet
GHSA-w86f-rf9w-h3x6 · CVE-2026-47719 - CVSS 5.3 Medium
GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
- Server-side request forgery (SSRF)
>=4.0.0, <4.4.5 || >=5.0.0, <5.0.2 · fixed in 4.4.5, 5.0.2
GHSA-hw9r-6m78-w6h3 · CVE-2026-39922 - CVSS 5.1 Medium
jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery
- jishenghua jshERP
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery
- perfree go-fastdfs-web
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Server-Side Request Forgery in Altium Platform Design GraphQL Service Allows Information Disclosure
- Altium Enterprise Server
- Altium 365
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP
- Server-side request forgery (SSRF)
<2.3.0 · fixed in 2.3.0
GHSA-q4x5-8cj6-52wg · CVE-2026-47684 - CVSS 5.3 Medium
NocoDB: Server-Side Request Forgery via Database Connection Host
- Server-side request forgery (SSRF)
<2026.05.1 · fixed in 2026.05.1
GHSA-w43h-r5m5-p832 · CVE-2026-47382 - CVSS 2.7 Low
Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
- Path traversal
- Information disclosure
<1.6.6 || >=1.7.0, <1.7.3 · fixed in 1.6.6, 1.7.3
GHSA-c66c-vq6w-fvh5 · CVE-2026-45723 - CVSS 5.3 Medium
Server-Side Request Forgery (SSRF) allowing Internal Network Probing in linqi
- linqi
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery
- wpdevteam Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
- Server-side request forgery (SSRF)
>=6.7.0.0, <6.7.10.1 · fixed in 6.7.10.1
GHSA-gq96-5pfx-f4vc · CVE-2026-48013 - CVSS 9.9 CriticalCritical · CVSS 9+
Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay
- Tautulli
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery
- crmeb_java
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Docling Core: Unsafe remote filename resolution
- Path traversal
- Server-side request forgery (SSRF)
>=1.5.0, <2.74.1 · fixed in 2.74.1
GHSA-jmmv-h3mp-59v8 · CVE-2026-44023 - CVSS 8.2 High
Docling: Unsafe Playwright-based HTML Rendering
- Code injection
- Server-side request forgery (SSRF)
>=2.82.0, <2.91.0 · fixed in 2.91.0
GHSA-pj2v-ggqh-cmq2 · CVE-2026-44016 - CVSS 8.6 HighCritical · KEV, CVSS 7+ and EPSSKEV
Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
- Cisco Unified Communications Manager
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
DesktopCommanderMCP is vulnerable to SSRF
- Server-side request forgery (SSRF)
<=0.2.37 · no fixed version yet
GHSA-5xx3-j724-wmx5 · CVE-2026-10690 - CVSS 6.5 Medium
Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
ahujasid blender-mcp ZIP File server.py requests.get server-side request forgery
- ahujasid blender-mcp
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint
- medplum
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery
- nextlevelbuilder GoClaw
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
DedeCMS download.php base64_decode server-side request forgery
- DedeCMS
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Nanobot contains a server-side request forgery vulnerability in the web_fetch tool
- Server-side request forgery (SSRF)
<0.2.1 · fixed in 0.2.1
GHSA-434r-7c99-hwf3 · CVE-2026-49138 - CVSS 7.0 High
Nanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning
- HKUDS nanobot
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery
- SourceCodester SEO Meta Tag Extractor
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery
- horizon921 mcpilot
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery
- hekmon8 Jenkins-server-mcp
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
indrasishbanerjee aem-mcp-server Axios Request Flow mcp-server.ts getAssetMetadata server-side request forgery
- indrasishbanerjee aem-mcp-server
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Apache Fesod is vulnerable to Server-Side Request Forgery through its UrlImageConverter component
- Server-side request forgery (SSRF)
<2.0.2-incubating · fixed in 2.0.2-incubating
GHSA-vqc2-c9jh-3jjv · CVE-2026-49328 - CVSS 5.8 Medium
Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints
- Server-side request forgery (SSRF)
<=1.5.52 · no fixed version yet
GHSA-698x-9w2p-7vvp · CVE-2026-10517 - CVSS 5.3 Medium
jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet server-side request forgery
- jeecgboot The server processes these URLs
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
JeecgBoot test server-side request forgery
- JeecgBoot
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
JeecgBoot edit WordUtil.addImage server-side request forgery
- JeecgBoot
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint
- Server-side request forgery (SSRF)
<=0.86.2 · no fixed version yet
GHSA-hchg-qm84-cj9p · CVE-2026-10177 - CVSS 5.5 Medium
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
- Server-side request forgery (SSRF)
<4.6.40 · fixed in 4.6.40
GHSA-5c6w-wwfq-7qqm · CVE-2026-47390 - CVSS 6.4 Medium
Nezha's authenticated DDNS webhook configuration allows blind SSRF from the dashboard host
- Server-side request forgery (SSRF)
>=0.20.0 · no fixed version yet
GHSA-6x26-5727-rrm9 · CVE-2026-47268 - CVSS 5.3 Medium
Spatie Laravel Media Library contains a server-side request forgery vulnerability
- Server-side request forgery (SSRF)
<11.23.0 · fixed in 11.23.0
GHSA-fggg-964j-3j7h · CVE-2026-48555 - CVSS 7.1 High
CC-Tweaked has an SSRF Protection Bypass with NAT64
- Server-side request forgery (SSRF)
<1.119.0 · fixed in 1.119.0
GHSA-5jh9-2h63-pw4q · CVE-2026-47695 - CVSS 7.7 High
Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
- Server-side request forgery (SSRF)
<9.3.5 · fixed in 9.3.5
GHSA-7j2f-6h2r-6cqc · CVE-2026-47260 - CVSS 7.7 High
FastGPT: SSRF Protection Bypass via `externalFile` in Dataset Preview API
- labring FastGPT
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-side request forgery in JetBrains TeamCity
- JetBrains TeamCity
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Gotenberg has an SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes
- Server-side request forgery (SSRF)
- CWE-184
<=8.32.0 · no fixed version yet
GHSA-86m8-88fq-xfxp · CVE-2026-45741 - CVSS 7.0 High
MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint
- jxxghp MoviePilot
- Server-side request forgery (SSRF)
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
- Server-side request forgery (SSRF)
- CWE-289
<0.32.0 || >=1.15.0, <1.16.0 · fixed in 0.32.0, 1.16.0
GHSA-pjwm-pj3p-43mv · CVE-2026-44492 - CVSS 6.9 Medium
Shibby Tomato SUBSCRIBE Call miniupnpd send server-side request forgery
- Shibby Tomato
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints
- Red Hat Quay 3
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access
- Elastic Kibana
- Server-side request forgery (SSRF)