Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.1 CriticalCritical · CVSS 9+
Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call
- RRWO Plack::App::Prerender
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
VeloCloud Orchestrator Missing Input Validation SSRF
- Arista Networks VeloCloud Orchestrator On-Prem
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability
- Themeisle Feedzy
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress AffiliateX plugin <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability
- WPCenter AffiliateX
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability
- Shahadat Hossain 3D Flipbook PDF Viewer & Embedder
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects
- MoonshotAI Kimi Code
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Printcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery
- Printcart Web to Print Product Designer for WooCommerce
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery
- mf-yang openclaw-cn
- Server-side request forgery (SSRF)
- CVSS 5.9 Medium
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
- Server-side request forgery (SSRF)
<1.5.6 · fixed in 1.5.6
GHSA-8q49-2h5h-434x - CVSS 5.3 Medium
Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests
- Broken access control
- Server-side request forgery (SSRF)
<=3.0.0-20250225100611-da4e44b77af4 · no fixed version yet
GHSA-v6w6-358x-2433 · CVE-2026-101048 - CVSS 9.4 CriticalCritical · CVSS 9+
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
- Path traversal
- Denial of service
<5.1.2 · fixed in 5.1.2
GHSA-68r5-9hpg-7qw9 - CVSS 4.9 Medium
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
- Server-side request forgery (SSRF)
<=3.38.1 · no fixed version yet
GHSA-hfhx-w8p8-4hc7 · CVE-2026-73307 - CVSS 8.5 High
Budibase: SSRF via DNS rebinding in the REST datasource integration
- Race condition
- Server-side request forgery (SSRF)
<=3.38.1 · no fixed version yet
GHSA-v42f-v8xc-j435 · CVE-2026-73410 - CVSS 8.4 High
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
- Server-side request forgery (SSRF)
<=3.38.1 · no fixed version yet
GHSA-xg5g-26x8-cvf4 · CVE-2026-72855 - CVSS 7.7 High
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal
- Path traversal
- Server-side request forgery (SSRF)
>=0.9.6, <0.10.0 · fixed in 0.10.0
GHSA-frvj-c5qp-xj4w · CVE-2026-59221 - CVSS 7.0 High
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
- Path traversal
- Server-side request forgery (SSRF)
<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5
GHSA-4rj6-vrwv-wr8m · CVE-2026-59863 - CVSS 7.1 High
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
- Path traversal
- Server-side request forgery (SSRF)
<1.29.1 || >=1.30.0, <1.32.5 · fixed in 1.29.1, 1.32.5
GHSA-rg4h-fpcp-2qm8 · CVE-2026-59867 - CVSS 10.0 CriticalCritical · CVSS 9+
Data Quality Elevation of Privilege Vulnerability
- Microsoft Purview Data Governance
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
Quay: ssrf in red hat quay notification webhooks (slack/generic)
- Red Hat OpenShift Update Service
- Red Hat Quay 3
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Multiple Security Vulnerabilities in Snowflake libsnowflakeclient
- Snowflake libsnowflakeclient
- Snowflake PHP PDO Driver
- Memory corruption
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Azure AI Search Elevation of Privilege Vulnerability
- Microsoft Azure AI Search
- Server-side request forgery (SSRF)
- CVSS 8.3 High
9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch
- decolua 9router
- Server-side request forgery (SSRF)
- CVSS 7.2 High
CCure and Victor Application Server - Server Side Request Forgery
- Johnson Controls CCure 9000 and victor application server
- Server-side request forgery (SSRF)
- CVSS 7.7 High
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
- Server-side request forgery (SSRF)
<1.30.6 || >=2.0.0, <2.1.18 || >=2.2.0, <2.4.7 || >=3.3.0, <3.10.7 || >=4.0.0, <5.8.1 · fixed in 1.30.6, 2.1.18, 2.4.7, 3.10.7, 5.8.1
GHSA-6hq5-7373-42rg · CVE-2026-59931 - CVSS 7.2 High
WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability
- Pepro Dev. Group PeproDev Ultimate Invoice
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability
- Complianz
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability
- Crocoblock. Jetimpex Inc. JetEngine
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability
- Crocoblock. Jetimpex Inc. JetBooking
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability
- Ronald Huereca Photo Block
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension
- regularlabs.com Cache Cleaner Pro extension for Joomla
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions
- regularlabs.com Articles Anywhere Pro extension for Joomla
- regularlabs.com Users Anywhere Pro extension for Joomla
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Next.js: Server-Side Request Forgery in Server Actions on custom servers
- Server-side request forgery (SSRF)
>=14.1.1, <15.5.21 || >=16.0.0, <16.2.11 · fixed in 15.5.21, 16.2.11
GHSA-89xv-2m56-2m9x · CVE-2026-64649 - CVSS 8.3 High
Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
- Open redirect
- Server-side request forgery (SSRF)
>=12.0.0, <15.5.21 || >=16.0.0, <16.2.11 · fixed in 15.5.21, 16.2.11
GHSA-p9j2-gv94-2wf4 · CVE-2026-64645 - CVSS 8.2 High
n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
- Information disclosure
- Memory corruption
<1.123.67 || >=2.0.0-rc.0, <2.31.5 || >=2.32.0, <2.32.1 · fixed in 1.123.67, 2.31.5, 2.32.1
GHSA-2x35-3fw4-9jr4 · CVE-2026-72766 - CVSS 6.4 Medium
n8n: SSRF Protection Bypass via MCP Client Node
- Server-side request forgery (SSRF)
<2.31.5 || >=2.32.0, <2.32.1 · fixed in 2.31.5, 2.32.1
GHSA-vhf8-cg2h-cg3p · CVE-2026-72768 - CVSS 6.3 Medium
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
- Server-side request forgery (SSRF)
<1.123.64 || >=2.0.0-rc.0, <2.29.8 || >=2.30.0, <2.30.1 · fixed in 1.123.64, 2.29.8, 2.30.1
GHSA-9w78-79q7-r4fp · CVE-2026-65593 - CVSS 6.5 Medium
RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX
- Progress Software Telerik UI for ASP.NET AJAX
- Server-side request forgery (SSRF)
- CVSS 4.0, no score published
Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access
- Server-side request forgery (SSRF)
* · no fixed version yet
GHSA-38fj-36m5-783c - CVSS 8.3 High
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
- Server-side request forgery (SSRF)
<1.27.0 · fixed in 1.27.0
GHSA-2wm4-vwp6-v7xc · CVE-2026-34966 - CVSS 9.2 CriticalCritical · CVSS 9+
Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader
- Weaviate Verba
- Server-side request forgery (SSRF)
- CVSS 9.2 CriticalCritical · CVSS 9+
Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass
- Weaviate Verba
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Gitea: Two SSRF findings
- Server-side request forgery (SSRF)
<1.27.0 · fixed in 1.27.0
GHSA-2fcr-jfvc-vgg2 · CVE-2026-58314 - CVSS 9.2 CriticalCritical · CVSS 9+
Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck
- keep
- Server-side request forgery (SSRF)
- CVSS 8.3 High
mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering
- mzxrai mcp-webresearch
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass
- Information disclosure
- Server-side request forgery (SSRF)
<1.27.0 · fixed in 1.27.0
GHSA-h2x6-g7q6-344v · CVE-2026-58442 - CVSS 6.3 Medium
Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
- Server-side request forgery (SSRF)
<1.27.0 · fixed in 1.27.0
GHSA-xmj7-xj85-hfc3 · CVE-2026-58441 - CVSS 7.7 High
LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass
- InternLM lmdeploy
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Gitea: SSRF via HTTP Redirect in Repository Migration
- Server-side request forgery (SSRF)
<1.26.4 · fixed in 1.26.4
GHSA-rqhx-647v-wx32 · CVE-2026-58418 - CVSS 9.6 CriticalCritical · CVSS 9+
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
- Server-side request forgery (SSRF)
<1.26.3 · fixed in 1.26.3
GHSA-2r5c-gw76-rh3w · CVE-2026-22874 - CVSS 3.1 Low
Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
- Server-side request forgery (SSRF)
<1.27.0 · fixed in 1.27.0
GHSA-x77v-q46j-393g · CVE-2026-23603 - CVSS 8.5 High
Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
- Server-side request forgery (SSRF)
<1.27.0 · fixed in 1.27.0
GHSA-82f7-87hm-852x · CVE-2026-57894 - CVSS 6.8 Medium
Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
- Server-side request forgery (SSRF)
- CWE-183
>=0.31.0, <0.33.0 || >=1.15.0, <1.18.0 · fixed in 0.33.0, 1.18.0
GHSA-f4gw-2p7v-4548 · CVE-2026-67315 - CVSS 5.3 Medium
AVideo Encoder downloadURL SSRF via unpinned retry fallback
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Directus: SSRF Protection Bypass via 0.0.0.0 in File Import
- Server-side request forgery (SSRF)
<12.0.0 · fixed in 12.0.0
GHSA-j5h6-vqc3-phqh · CVE-2026-61835 - CVSS 6.5 Medium
Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses
- Server-side request forgery (SSRF)
<=3.0.0-20250225100611-da4e44b77af4 · no fixed version yet
GHSA-x756-g4x3-c64m · CVE-2026-54562 - CVSS 6.3 Medium
Huginn < 2026.09.09 SSRF via ScenarioImport fetch_url Method
- huginn
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint
- hyperdx
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
HyperDX < 2.31.0 SSRF via Webhook Test Endpoint
- hyperdx
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
LimeSurvey SSRF via REST API Survey Template Host Header
- LimeSurvey
- Server-side request forgery (SSRF)