Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.1 Medium
Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load
- Snowflake CLI
- Server-side request forgery (SSRF)
- CWE-829
- CVSS 9.9 CriticalCritical · CVSS 9+
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
- Broken access control
- Server-side request forgery (SSRF)
<1.9.2 · fixed in 1.9.2
GHSA-v2wp-frmc-5q3v · CVE-2026-55166 - CVSS 9.3 CriticalCritical · CVSS 9+
pyLoad: SSRF filter bypass via HTTP redirect in BaseDownloader (Incomplete fix for CVE-2026-33992)
- Server-side request forgery (SSRF)
<=0.5.0b3.dev96 · no fixed version yet
GHSA-7gvf-3w72-p2pg · CVE-2026-35459 - CVSS 9.3 CriticalCritical · CVSS 9+
pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
- Server-side request forgery (SSRF)
<=0.5.0b3.dev96 · no fixed version yet
GHSA-m74m-f7cr-432x · CVE-2026-33992 - CVSS 8.6 High
MLflow Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
<2.9.2 · fixed in 2.9.2
GHSA-59v3-898r-qwhj · CVE-2023-6974 - CVSS 5.3 Medium
GitBucket RepositoryCreationService.scala Git.cloneRepository.setURI server-side request forgery
- GitBucket
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
- Race condition
- Server-side request forgery (SSRF)
<5.73.24 || >=6.0.0, <6.20.1 · fixed in 5.73.24, 6.20.1
GHSA-v5c4-wcpj-x73m · CVE-2026-54242 - CVSS 6.5 Medium
PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
- Server-side request forgery (SSRF)
<2.6.0 · fixed in 2.6.0
GHSA-x8g9-h984-pc36 · CVE-2026-49359 - CVSS 3.0 Low
Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy
- Race condition
- Server-side request forgery (SSRF)
<0.10.4 · fixed in 0.10.4
GHSA-mmj8-wcvw-6789 · CVE-2026-49262 - CVSS 0.0 None
@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url
- Path traversal
- Denial of service
<0.1.2 · fixed in 0.1.2
GHSA-rp72-5v5q-2446 - CVSS 10.0 CriticalCritical · KEV, CVSS 9+KEV
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
- kestra
- Command injection
- Authentication bypass
- CVSS 7.4 High
Hysteria has an authenticated UDP ACL bypass that enables localhost and private-network UDP SSRF
- Broken access control
- Server-side request forgery (SSRF)
>=2.0.0, <2.9.2 · fixed in 2.9.2
GHSA-vgrc-hq28-p3xp - CVSS 6.8 Medium
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
- Server-side request forgery (SSRF)
>=1.56.0, <1.102.0 || >=2.0.0b1, <2.0.0b3 · fixed in 1.102.0, 2.0.0b3
GHSA-cg7w-rg45-pc59 · CVE-2026-48782 - CVSS 7.2 High
Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`
- Server-side request forgery (SSRF)
<1.19.3 · fixed in 1.19.3
GHSA-72f5-rr8c-r6gr · CVE-2026-44161 - CVSS 8.5 High
AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability
- Themeum Kirki
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability
- Chris Carlevato utm.codes
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server
- Mattermost
- Server-side request forgery (SSRF)
- CVSS 2.1 Low
Server-side request forgery in danpros HTMLy
- danpros HTMLy
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
- WSO2 API Manager
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin
- Rapid7 InsightConnect Markdown Plugin
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address
- Server-side request forgery (SSRF)
<1.10.0-rc.0 · fixed in 1.10.0-rc.0
GHSA-cgm6-wvp9-4g5h · CVE-2026-13318 - CVSS 7.4 High
Apicurio Registry allows upload of WSDL raising HTTP request
- Server-side request forgery (SSRF)
>=3.3.0, <3.3.1 || <3.2.6 · fixed in 3.3.1, 3.2.6
GHSA-rcmh-vfq7-8gf4 · CVE-2026-12992 - CVSS 6.3 Medium
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF
- Server-side request forgery (SSRF)
<1.9.2 · fixed in 1.9.2
GHSA-54vg-pfh7-jq95 · CVE-2026-55162 - CVSS 8.3 High
OHIF Viewers DICOM Server-Side request forgery
- Open Health Imaging Foundation (OHIF) DICOM Web Viewer Framework
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint
- samuelclay NewsBlur
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Huly Platform - Server-Side Request Forgery via /import Endpoint
- hcengineering platform
- Server-side request forgery (SSRF)
- CVSS 8.3 High
ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise
- ToolJet
- Server-side request forgery (SSRF)
- CVSS 7.7 High
LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs
- danny-avila LibreChat
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter
- appsmith
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
- appsmith
- Server-side request forgery (SSRF)
- CVSS 8.9 High
Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route
- appsmith
- Server-side request forgery (SSRF)
- CWE-183
- CVSS 8.6 High
Mastodon: SSRF protection bypass on older Ruby versions
- mastodon
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)
- mastodon
- Server-side request forgery (SSRF)
- CVSS 7.3 High
Payara Server Full has a Cross-Site Request Forgery vulnerability
- Cross-site request forgery (CSRF)
- Server-side request forgery (SSRF)
>=4.0.0, <7.2026.6 · fixed in 7.2026.6
GHSA-x939-7fq5-v9v6 · CVE-2026-12986 - CVSS 7.1 High
Jenkins Assembla Plugin has an XXE vulnerability
- Server-side request forgery (SSRF)
<=1.4 · no fixed version yet
GHSA-2q27-6p2h-q6r3 · CVE-2026-57303 - CVSS 6.9 Medium
SSRF in Pentestify PDF generation endpoint via Host header
- Pentestify
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Kargo Takip <= 1.2 - Unauthenticated Server-Side Request Forgery via 'api_url' Parameter
- bytuncay Kargo Takip
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter
- joomunited WP Meta SEO
- Server-side request forgery (SSRF)
- CVSS 7.2 High
URL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
- abhisheksaha11 URL Preview
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
- Server-side request forgery (SSRF)
>=2.0.0, <2.18.8 || >=2.19.0, <2.21.4 · fixed in 2.18.8, 2.21.4
GHSA-hgj6-7826-r7m5 · CVE-2026-54514 - CVSS 8.7 High
Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft
- Server-side request forgery (SSRF)
<0.14.3 · fixed in 0.14.3
GHSA-g2f5-gjr4-qjvm · CVE-2026-52805 - CVSS 7.1 High
Duplicate Advisory: Flowise Execute Flow function has an SSRF vulnerability
- Server-side request forgery (SSRF)
<3.1.0 · fixed in 3.1.0
GHSA-w4hm-rrxg-pxcf - CVSS 8.5 High
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation
- Race condition
- Server-side request forgery (SSRF)
<3.39.9 · fixed in 3.39.9
GHSA-gfq7-5x4g-3xhf · CVE-2026-54353 - CVSS 8.5 High
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata
- Server-side request forgery (SSRF)
<3.39.0 · fixed in 3.39.0
GHSA-4q6h-8p4v-67vq · CVE-2026-48153 - CVSS 8.3 High
Gogs has SSRF in webhook deliveries
- Server-side request forgery (SSRF)
<0.14.3 · fixed in 0.14.3
GHSA-c4v7-xg93-qf8g · CVE-2026-47267 - CVSS 5.3 Medium
Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module
- Server-side request forgery (SSRF)
<1.5.0 · fixed in 1.5.0
GHSA-7wwh-xcc3-9fcg · CVE-2026-44583 - CVSS 5.3 Medium
OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
- Server-side request forgery (SSRF)
<16.1.1 · fixed in 16.1.1
GHSA-c556-q2mh-477v · CVE-2026-44202 - CVSS 7.7 High
OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature
- Server-side request forgery (SSRF)
- CWE-20
<6.8.16 · fixed in 6.8.16
GHSA-ffm6-vvph-g5f5 · CVE-2026-21887 - CVSS 7.4 High
IBM WebSphere Application Server is affected by server-side request forgery
- IBM WebSphere Application Server
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
activepieces File URL file.ts handleUrlFile server-side request forgery
- activepieces
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
- Server-side request forgery (SSRF)
<=1.82.2 · no fixed version yet
GHSA-c693-x898-5g4h · CVE-2026-12798 - CVSS 5.3 Medium
BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery
- BerriAI litellm
- Server-side request forgery (SSRF)
- CVSS 6.1 Medium
AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter
- AVideo
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Capgo - Server-Side Request Forgery via Webhook URL Validation
- Capgo
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch
- Server-side request forgery (SSRF)
<3.1.5 · fixed in 3.1.5
GHSA-h5rg-8p7f-47g2 · CVE-2026-63744 - CVSS 8.7 High
Lokka: Azure Resource Manager URL path validation issue
- Server-side request forgery (SSRF)
<2.1.2 · fixed in 2.1.2
GHSA-g2gw-q38m-vjfc · CVE-2026-58201 - CVSS 5.9 Medium
Zeep: Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
>=4.0.0, <4.3.3 · fixed in 4.3.3
GHSA-4cc2-g9w2-fhf6 · CVE-2026-58501 - CVSS 7.1 High
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
- Server-side request forgery (SSRF)
<1.7.1 · fixed in 1.7.1
GHSA-mrvx-jmjw-vggc · CVE-2026-58485