Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id
- Simple Google Calendar Outlook Events Widget
- Server-side request forgery (SSRF)
- CVSS 6.1 Medium
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Microsoft Edge (Chromium-based)
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Campaign Classic
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Guzzle: Noncanonical host can bypass host-based checks
- Server-side request forgery (SSRF)
- CWE-180
<7.15.2 || >=8.0.0, <8.0.1 · fixed in 7.15.2, 8.0.1
GHSA-v5mv-p594-2x33 · CVE-2026-69246 - CVSS 6.9 Medium
jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery
- jina-ai reader
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution
- Shlink
- Server-side request forgery (SSRF)
- CVSS 7.7 High
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
- Server-side request forgery (SSRF)
- CWE-20
<10.3.1 · fixed in 10.3.1
GHSA-mwp4-54f8-5fhr · CVE-2026-69192 - CVSS 6.9 Medium
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
- Server-side request forgery (SSRF)
- CWE-20
>=10.1.1, <10.2.2 · fixed in 10.2.2
GHSA-4xrf-jv44-h6hh · CVE-2026-69198 - CVSS 6.9 Medium
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
- Server-side request forgery (SSRF)
- CWE-20
>=10.1.1, <10.2.1 · fixed in 10.2.1
GHSA-22jq-vg5j-6vgg · CVE-2026-54272 - CVSS 8.8 High
Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering
- misp cti-transmute
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect
- budibase
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX
- Pixelavo
- Server-side request forgery (SSRF)
- CVSS 3.7 Low
@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header
- Server-side request forgery (SSRF)
<4.31.0 · fixed in 4.31.0
GHSA-34pj-2622-jvxq · CVE-2026-53607 - CVSS 8.2 High
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
- Server-side request forgery (SSRF)
- Denial of service
<7.8.0 · fixed in 7.8.0
GHSA-6x26-6r6f-m537 · CVE-2026-53500 - CVSS 9.6 CriticalCritical · CVSS 9+
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
- Server-side request forgery (SSRF)
<1.23.1 · fixed in 1.23.1
GHSA-r2v3-8gwf-7ghm · CVE-2026-54725 - CVSS 8.7 High
dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
- Server-side request forgery (SSRF)
<1.0.5 · fixed in 1.0.5
GHSA-5846-7qm3-r52j · CVE-2026-54729 - CVSS 8.6 High
Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
- Server-side request forgery (SSRF)
<3.10.0 · fixed in 3.10.0
GHSA-qvv7-cg9c-w4x3 · CVE-2026-12075 - CVSS 5.3 Medium
Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs
- ccyl13 Pentestify
- Server-side request forgery (SSRF)
- CVSS 8.0 High
Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox
- Google mcp-toolbox
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request.
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WACRM: SSRF via the automation `send_webhook` action
- ArnasDon wacrm
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
CVE-2026-15974
- SGLang
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
- CVSS 8.4 High
Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()
- Leantime
- Server-side request forgery (SSRF)
- CVSS 8.4 High
Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation
- Kanboard
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation
- Server-side request forgery (SSRF)
<2.26.7 · fixed in 2.26.7
GHSA-c9hr-64h3-gxpc · CVE-2026-67424 - CVSS 8.5 High
Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)
- Server-side request forgery (SSRF)
<2.26.7 · fixed in 2.26.7
GHSA-pgwh-4jj4-qm8v · CVE-2026-67428 - CVSS 9.3 CriticalCritical · CVSS 9+
Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration
- Authentication bypass
- Hard-coded credentials
>=2.26.6, <2.26.7 · fixed in 2.26.7
GHSA-jx74-cqjv-2c67 · CVE-2026-67426 - CVSS 6.0 Medium
linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect
- Information disclosure
- Server-side request forgery (SSRF)
<6.0.0 · fixed in 6.0.0
GHSA-4jc5-g844-4x33 · CVE-2026-67435 - CVSS 7.7 High
Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass
- kyegomez swarms
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching
- Server-side request forgery (SSRF)
>=2.3.2, <2.3.7 · fixed in 2.3.7
GHSA-5q9h-vf5j-fr2g · CVE-2026-54885 - CVSS 6.8 Medium
Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url
- Red Hat Cost Management 4
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)
- Red Hat Cost Management 4
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address
- Red Hat Cost Management 4
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects
- Red Hat Certificate System 10.4 EUS for RHEL-8
- Red Hat Certificate System 10
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass
- Eclipse Foundation Eclipse CSI - PIA
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Linuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* plugins
- Linuxfabrik monitoring-plugins
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 8.6 High
consul-mcp-server vulnerable to server side request forgery leading to token exposure
- HashiCorp Tooling
- Server-side request forgery (SSRF)
- CVSS 2.7 Low
Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network
- Server-side request forgery (SSRF)
<1.6.1 · fixed in 1.6.1
GHSA-pm5p-7w5h-jm5q · CVE-2026-52840 - CVSS 10.0 CriticalCritical · CVSS 9+
prebid-server's request forgery vulnerability allows for possible host environment data extraction
- Server-side request forgery (SSRF)
<=0.275.0 · no fixed version yet
GHSA-4p3g-4hcj-wpvx · CVE-2026-54735 - CVSS 6.1 Medium
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
- Server-side request forgery (SSRF)
- CWE-20
<13.12.2 · fixed in 13.12.2
GHSA-x36r-4347-pm5x · CVE-2026-54663 - CVSS 7.4 High
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
- Information disclosure
- Hard-coded credentials
<13.12.2 · fixed in 13.12.2
GHSA-h754-fxp7-88wx · CVE-2026-54660 - CVSS 4.9 Medium
WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery
- blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification
- Apache Software Foundation Apache Traffic Server
- Server-side request forgery (SSRF)
- CVSS 7.5 High
datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
- Race condition
- Server-side request forgery (SSRF)
<0.63.0 · fixed in 0.63.0
GHSA-vx7x-vcc2-c44g · CVE-2026-55391 - CVSS 8.2 High
datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)
- Server-side request forgery (SSRF)
>=0.9.1, <0.61.0 · fixed in 0.61.0
GHSA-954p-556p-r752 · CVE-2026-54690 - CVSS 8.2 High
datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects
- Server-side request forgery (SSRF)
>=0.9.1, <0.61.0 · fixed in 0.61.0
GHSA-rfr2-mq9m-x2qx · CVE-2026-54691 - CVSS 4.1 Medium
Media Cleaner: Clean your WordPress! <= 7.0.3 - Authenticated (Administrator+) Server-Side Request Forgery
- tigroumeow Media Cleaner: Clean your WordPress!
- Server-side request forgery (SSRF)
- CVSS 8.6 High
terraform-mcp-server vulnerable to server side request forgery leading to token exposure
- HashiCorp Tooling
- Server-side request forgery (SSRF)
- CVSS 7.2 High
OAuth: Cross-origin token-request redirects can expose signed request metadata
- Information disclosure
- Server-side request forgery (SSRF)
>=0.5.5, <1.1.6 · fixed in 1.1.6
GHSA-prq8-7wvh-44qh · CVE-2026-54605 - CVSS 6.8 Medium
@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
- Server-side request forgery (SSRF)
<3.17.0 · fixed in 3.17.0
GHSA-vg6v-j97m-h5xq · CVE-2026-125115 - CVSS 8.2 High
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor
- Server-side request forgery (SSRF)
- CWE-441
>=8.2.1, <10.1.1 · fixed in 10.1.1
GHSA-28f5-38xr-jh2w · CVE-2026-43910 - CVSS 5.1 Medium
Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests
- pivotick
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability
- Subtle Web Inc FormCraft
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability
- QuantumCloud Simple Link Directory Pro
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Potential server-side request forgery in Artifactory Ansible repository handling
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Server-Side Request Forgery (SSRF) via Terraform Remote repository
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Server-Side Request Forgery (SSRF) via JFrog Artifactory Cargo remote repository
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Improper URL validation when handling specific URLs Pub, Terraform and Docker packages might lead to SSRF vulnerability
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 6.0 Medium
Server-Side Request Forgery (SSRF) and Credential Exfiltration in googleapis/mcp-toolbox cloud-healthcare-fhir-fetch-page Tool
- MCP Toolbox for Databases (googleapis/mcp-toolbox)
- Server-side request forgery (SSRF)