Advisories · Weakness

Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

github.com/QuantumNous/new-api Go

CVSS 7.7 High

New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
- Server-side request forgery (SSRF)
<0.12.0-alpha.1 · fixed in 0.12.0-alpha.1

GHSA-6qcr-qxgr-m7fv · CVE-2026-33655 Not analysed yet 7 Jul 2026
CVE-2026-34170 CVE record

CVSS 4.3 Medium

Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL
- coollabsio coolify
- Server-side request forgery (SSRF)
Not analysed yet 7 Jul 2026
CVE-2026-42147 CVE record

CVSS 4.9 Medium

Coolify: SSRF via S3 Storage Endpoint in testConnection()
- coollabsio coolify
- Server-side request forgery (SSRF)
Not analysed yet 7 Jul 2026
github.com/coder/coder/v2 Go

CVSS 8.3 High

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write
- Broken access control
- Server-side request forgery (SSRF)
>=2.27.0, <2.29.19 || >=2.30.0, <2.32.9 || >=2.33.0, <2.33.10 || >=2.34.0, <2.34.4 · fixed in 2.29.19, 2.32.9, 2.33.10, 2.34.4

GHSA-qrwj-vh9x-gw5v · CVE-2026-63443 Not analysed yet 6 Jul 2026
d7y.io/dragonfly/v2 Go

CVSS 5.5 Medium

Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile
- Server-side request forgery (SSRF)
<2.4.4-rc.3 · fixed in 2.4.4-rc.3

GHSA-chwm-m7g7-685g · CVE-2026-54637 Not analysed yet 6 Jul 2026
flyto-core PyPI

CVSS 7.1 High

flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
- Server-side request forgery (SSRF)
<2.26.3 · fixed in 2.26.3

GHSA-794r-5rp2-fpg8 · CVE-2026-55787 Not analysed yet 6 Jul 2026
CVE-2025-53830 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
- Anti-Virus for ownCloud
- ownCloud 10
- Server-side request forgery (SSRF)
Not analysed yet 6 Jul 2026
CVE-2025-53828 CVE record

CVSS 8.5 High

SharePoint for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
- owncloud SharePoint
- ownCloud 10
- Server-side request forgery (SSRF)
Not analysed yet 6 Jul 2026
org.apache.camel:camel-atmosphere-websocket Maven

CVSS 7.5 High

Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy
- Information disclosure
- Server-side request forgery (SSRF)
>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

GHSA-rcvm-6r79-cf4r · CVE-2026-55993 Not analysed yet 6 Jul 2026
org.apache.camel:camel-iggy Maven

CVSS 7.5 High

Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy
- Information disclosure
- Server-side request forgery (SSRF)
>=4.17.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.18.3, 4.21.0

GHSA-pw9q-pq7c-rfqw · CVE-2026-55994 Not analysed yet 6 Jul 2026
org.apache.camel:camel-dns Maven

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
- CWE-20
>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

GHSA-hcm8-x79p-wx2w · CVE-2026-48205 Not analysed yet 6 Jul 2026
org.apache.camel:camel-vertx-websocket Maven

CVSS 7.5 High

Apache Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy
- Information disclosure
- Server-side request forgery (SSRF)
>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

GHSA-hgg5-gp4c-gpcg · CVE-2026-46726 Not analysed yet 6 Jul 2026
org.apache.camel:camel-solr Maven

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields
- Other injection
- Server-side request forgery (SSRF)
>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

GHSA-4h4f-v54q-7pq8 · CVE-2026-48203 Not analysed yet 6 Jul 2026
CVE-2026-14748 CVE record

CVSS 5.3 Medium

AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery
- AIAnytime Awesome-MCP-Server
- Server-side request forgery (SSRF)
Not analysed yet 5 Jul 2026
CVE-2026-58278 CVE record

CVSS 5.4 Medium

Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Microsoft Edge (Chromium-based)
- Server-side request forgery (SSRF)
Not analysed yet 3 Jul 2026
CVE-2026-57993 CVE record

CVSS 7.4 High

Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Microsoft Edge (Chromium-based)
- Server-side request forgery (SSRF)
Not analysed yet 3 Jul 2026
CVE-2026-57987 CVE record

CVSS 6.5 Medium

Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Microsoft Edge (Chromium-based)
- Server-side request forgery (SSRF)
Not analysed yet 3 Jul 2026
CVE-2026-10055 CVE record

CVSS 8.5 High

Server-side request forgery in Eclipse Foundation Eclipse Theia
- Eclipse Foundation Eclipse Theia
- Information disclosure
- Server-side request forgery (SSRF)
Not analysed yet 3 Jul 2026
CVE-2026-11397 CVE record

CVSS 5.5 Medium

WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter
- vjinfotech WP Import Export Lite
- Server-side request forgery (SSRF)
Not analysed yet 3 Jul 2026
CVE-2026-45499 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Azure OpenAI Elevation of Privilege Vulnerability
- Microsoft Azure Open AI
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
CVE-2026-57100 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
- Microsoft Entra Provisioning Service
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
mautic/core Packagist

CVSS 6.4 Medium

Mautic Focus component Vulnerable to SSRF
- Server-side request forgery (SSRF)
>=4.0.0, <=4.4.13 || >=5.0.0, <5.2.11 || >=6.0.0, <6.0.9 || >=7.0.0, <7.1.2 · fixed in 5.2.11, 6.0.9, 7.1.2

GHSA-jmv8-8j9j-rcpc · CVE-2026-9557 Not analysed yet 2 Jul 2026
CVE-2026-59101 CVE record

CVSS 6.9 Medium

AutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloader
- EstrellaXD Auto_Bangumi
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
CVE-2026-59095 CVE record

CVSS 8.3 High

LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl
- lobehub
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
@asymmetric-effort/specifyjs npm

CVSS 4.0, no score published

@asymmetric-effort/specifyjs: No redirect target validation in secureFetch
- Server-side request forgery (SSRF)
<0.2.136 · fixed in 0.2.136

GHSA-j5qp-p44g-2m49 Not analysed yet 2 Jul 2026
@asymmetric-effort/specifyjs npm

CVSS 4.0, no score published

@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction
- Server-side request forgery (SSRF)
<0.2.136 · fixed in 0.2.136

GHSA-2944-57xv-2682 Not analysed yet 2 Jul 2026
@asymmetric-effort/specifyjs npm

CVSS 4.0, no score published

@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)
- Server-side request forgery (SSRF)
<0.2.136 · fixed in 0.2.136

GHSA-xw57-23p8-9wc5 Not analysed yet 2 Jul 2026
@asymmetric-effort/specifyjs npm

CVSS 8.7 High

@asymmetric-effort/specifyjs: URL parse failure silently allows request
- Server-side request forgery (SSRF)
<0.2.136 · fixed in 0.2.136

GHSA-8882-frvv-92w4 · CVE-2026-50288 Not analysed yet 2 Jul 2026
openclaw npm

CVSS 6.0 Medium

OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs
- Hard-coded credentials
- Server-side request forgery (SSRF)
<2026.5.2 · fixed in 2026.5.2

GHSA-grc3-2j34-p6gm · CVE-2026-53827 Not analysed yet 2 Jul 2026
openclaw npm

CVSS 4.9 Medium

OpenClaw's browser act interactions could bypass private-network navigation checks
- Broken access control
- Server-side request forgery (SSRF)
<2026.5.18 · fixed in 2026.5.18

GHSA-2hfg-4fh4-qp7f · CVE-2026-53812 Not analysed yet 2 Jul 2026
CVE-2026-55115 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Server-side request forgery in Ubiquiti Inc UniFi Protect Application
- Ubiquiti Inc UniFi Protect Application
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
CVE-2026-55113 CVE record

CVSS 7.5 High

Server-side request forgery in Ubiquiti Inc UniFi Talk Application
- Ubiquiti Inc UniFi Talk Application
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
CVE-2026-54401 CVE record

CVSS 7.7 High

Server-side request forgery in Ubiquiti Inc UniFi OS Server and others
- Ubiquiti Inc UniFi OS Server
- Ubiquiti Inc Dream Machines
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
CVE-2026-57681 CVE record

CVSS 6.4 Medium

WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability
- Paolo GeoDirectory
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
CVE-2026-57348 CVE record

CVSS 7.2 High

WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability
- Cozmoslabs Paid Member Subscriptions
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
CVE-2026-54430 CVE record

CVSS 5.1 Medium

Server-Site Request Forgery in liboauth2
- OpenIDC liboauth2
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
CVE-2026-14336 CVE record

CVSS 8.2 High

Server-side request forgery in Eclipse Foundation Eclipse CSI - PIA
- Eclipse Foundation Eclipse CSI - PIA
- Server-side request forgery (SSRF)
Not analysed yet 2 Jul 2026
@apify/actors-mcp-server npm

CVSS 8.1 High

Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
- Server-side request forgery (SSRF)
<0.10.11 · fixed in 0.10.11

GHSA-6gr2-qh89-hxwm · CVE-2026-50143 Not analysed yet 1 Jul 2026
oras.land/oras-go/v2 Go

CVSS 7.5 High

oras-go blob upload vulnerable to credential forwarding via unvalidated Location header
- Server-side request forgery (SSRF)
<2.6.1 · fixed in 2.6.1

GHSA-jxpm-75mh-9fp7 · CVE-2026-50151 Not analysed yet 1 Jul 2026
oras.land/oras-go +1 Go

CVSS 2.1 Low

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
- Weak cryptography or TLS
- Server-side request forgery (SSRF)
<=1.2.7 · no fixed version yet

GHSA-xf85-363p-868w · CVE-2026-48978 Not analysed yet 1 Jul 2026
github.com/rancher/fleet Go

CVSS 5.0 Medium

Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
- Server-side request forgery (SSRF)
>=0.12.0, <0.12.15 || >=0.13.0, <0.13.11 || >=0.14.0, <0.14.6 || >=0.15.0, <0.15.2 · fixed in 0.12.15, 0.13.11, 0.14.6, 0.15.2

GHSA-hx4v-cxpf-vh8m · CVE-2026-44936 Not analysed yet 1 Jul 2026
github.com/rancher/fleet Go

CVSS 8.3 High

Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components
- Server-side request forgery (SSRF)
- CWE-345
>=0.12.0, <0.12.15 || >=0.13.0, <0.13.11 || >=0.14.0, <0.14.6 || >=0.15.0, <0.15.2 · fixed in 0.12.15, 0.13.11, 0.14.6, 0.15.2

GHSA-jmf4-m7j9-g72r · CVE-2026-44937 Not analysed yet 1 Jul 2026
surrealdb crates.io

CVSS 5.3 Medium

SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
- Server-side request forgery (SSRF)
<3.1.0 · fixed in 3.1.0

GHSA-97vg-427p-8hx5 · CVE-2026-63743 Not analysed yet 1 Jul 2026
auth-fetch-mcp npm

CVSS 7.4 High

auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
- Server-side request forgery (SSRF)
<3.0.2 · fixed in 3.0.2

GHSA-pvrj-8cg3-j5f8 · CVE-2026-49857 Not analysed yet 1 Jul 2026
@jshookmcp/jshook npm

CVSS 4.3 Medium

@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization
- Server-side request forgery (SSRF)
>=0.3.1, <0.3.2 · fixed in 0.3.2

GHSA-c5r6-m4mr-8q5j · CVE-2026-49856 Not analysed yet 1 Jul 2026
CVE-2026-24242 CVE record

CVSS 7.8 High

Server-side request forgery in NVIDIA Megatron-Bridge
- NVIDIA Megatron-Bridge
- Server-side request forgery (SSRF)
Not analysed yet 1 Jul 2026
CVE-2026-13603 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

SSRF with API key leak in pretix-oppwa
- pretix-oppwa
- Server-side request forgery (SSRF)
- CWE-20
Not analysed yet 1 Jul 2026
CVE-2026-56399 CVE record

CVSS 5.3 Medium

Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web
- open-webui
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
CVE-2025-36324 CVE record

CVSS 4.3 Medium

Vulnerabilities found in Watson Data Intelligence
- IBM watsonx.data intelligence
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
CVE-2026-10129 CVE record

CVSS 8.5 High

SSRF via HTTP Redirect Following in Langflow API Request Component
- IBM Langflow OSS
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
CVE-2026-10546 CVE record

CVSS 7.1 High

DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component
- IBM Langflow OSS
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
CVE-2026-10564 CVE record

CVSS 8.2 High

SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection
- IBM Langflow OSS
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
CVE-2026-11546 CVE record

CVSS 7.1 High

IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability
- IBM WebSphere Application Server - Liberty
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
CVE-2026-11714 CVE record

CVSS 8.5 High

IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability
- IBM WebSphere Application Server - Liberty
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
CVE-2026-13773 CVE record

CVSS 6.0 Medium

IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol
- IBM WebSphere Extreme Scale
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
github.com/sigstore/fulcio Go

CVSS 8.7 High

Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage
- Server-side request forgery (SSRF)
<1.8.6 · fixed in 1.8.6

GHSA-f5mr-q85p-6hh6 · CVE-2026-49478 Not analysed yet 30 Jun 2026
CVE-2026-48285 CVE record

CVSS 8.6 High

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
CVE-2026-13316 CVE record

CVSS 4.4 Medium

Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config
- Red Hat Satellite 6
- Server-side request forgery (SSRF)
Not analysed yet 30 Jun 2026
CVE-2026-57947 CVE record

CVSS 6.3 Medium

Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration
- pinpoint
- Server-side request forgery (SSRF)
Not analysed yet 29 Jun 2026
CVE-2026-56285 CVE record

CVSS 7.7 High

Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint
- zedeus nitter
- Server-side request forgery (SSRF)
- CWE-1188
Not analysed yet 29 Jun 2026