Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.6 High
Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning
- aehrc pathling
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 8.7 High
Pathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLs
- aehrc pathling
- Hard-coded credentials
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration
- aehrc pathling
- Hard-coded credentials
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}
- aehrc pathling
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification
- Sonatype Nexus Repository 3
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Improper URL Scheme and Destination Validation in SmartCenter browserseturl Command
- Vestel Telefunken TE24553B45V2DZ Smart TV
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects
- OPeNDAP Inc. hyrax-docker
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in link storing functionality
- Tobit Laboratories AG TeamDavid
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 6.3 Medium
TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality
- Tobit Laboratories AG TeamDavid
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 6.3 Medium
TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality
- Tobit Laboratories AG TeamDavid
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 7.7 High
TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionality
- Tobit Laboratories AG TeamDavid
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 5.4 Medium
Unauthenticated WebSocket-to-XAdES SSRF in Revenue Administration's E-Signature
- Revenue Administration E-Signature
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources
- fedify
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
WGDashboard Server-Side Request Forgery Vulnerability
- WGDashboard
- Server-side request forgery (SSRF)
- CVSS 9.2 CriticalCritical · CVSS 9+
Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL
- Efstratios Goudelis Ground Station
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Server-Side Request Forgery (SSRF) in eScriptorium
- Scripta eScriptorium
- Server-side request forgery (SSRF)
- CVSS 9.6 CriticalCritical · CVSS 9+
Server-side request forgery in Eclipse Foundation Eclipse GlassFish
- Eclipse Foundation Eclipse GlassFish
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
MissionSquad mcp-api dcrClients.ts server-side request forgery
- MissionSquad mcp-api
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Blind SSRF on Foxit PDF Services API
- Foxit Software Inc. Foxit PDF Services API
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler
- Newsletters
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
JeecgBoot Anonymous Chat Attachment send server-side request forgery
- JeecgBoot
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery
- heshengtao super-agent-party
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Server-Side Request Forgery (SSRF) in IBM Application Gateway Operator
- IBM Application Gateway Operator
- Server-side request forgery (SSRF)
- CVSS 5.9 Medium
Electron: HTTP redirect followed into local file loader
- Server-side request forgery (SSRF)
<39.8.8 || >=40.0.0-alpha.1, <40.9.1 || >=41.0.0-alpha.1, <41.2.1 || >=42.0.0-alpha.1, <42.0.0-beta.3 · fixed in 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3
GHSA-v64r-4m7r-3mvq · CVE-2026-70605 - CVSS 8.5 High
Server-side request forgery in Progress MarkLogic Server
- Progress Software Corporation MarkLogic Server
- Server-side request forgery (SSRF)
- CVSS 4.0 Medium
Ghost: Server-Side Request Forgery Mitigation Issue
- Server-side request forgery (SSRF)
>=6.26.0, <6.54.1 · fixed in 6.54.1
GHSA-x5mm-wm4g-j5xv · CVE-2026-70595 - CVSS 8.5 High
go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch
- shiori
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass
- memos
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess
- Stirling-Tools Stirling-PDF
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Firefly III - Webhook URL Validation Explicitly Allows Loopback and Is Bypassable via DNS Rebinding
- firefly-iii
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Pixelfed - Authenticated SSRF via Remote URL Search
- pixelfed
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Paperless-ngx - Mail Account Test Connection Leaks Stored IMAP/OAuth Credentials to Attacker-Controlled Host
- paperless-ngx
- Server-side request forgery (SSRF)
- CVSS 7.1 High
MLflow AI Gateway permits SSRF through an unvalidated api_base
- Server-side request forgery (SSRF)
>=3.13.0, <=3.15.2 · no fixed version yet
GHSA-h7x2-h6g9-p789 · CVE-2026-71211 - CVSS 6.5 Medium
KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation
- KubeSphere
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery
- Poesis Rhymix CMS
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
Ghost: Server-Side Request Forgery in Image Fetching
- Server-side request forgery (SSRF)
>=0.10.0, <6.54.1 · fixed in 6.54.1
GHSA-gcvv-72q8-9v76 · CVE-2026-70591 - CVSS 5.4 Medium
Ghost: Mobiledoc image-size fetch SSRF
- Server-side request forgery (SSRF)
>=6.19.4, <6.21.2 · fixed in 6.21.2
GHSA-g366-23fw-ggp6 · CVE-2026-53946 - CVSS 4.0 Medium
Ghost: Server-side request forgery via DNS rebinding in external request handling
- Race condition
- Server-side request forgery (SSRF)
>=6.0.9, <6.21.2 · fixed in 6.21.2
GHSA-ch52-px8q-f22j · CVE-2026-53945 - CVSS 6.1 Medium
Odysseus SSRF via Embedding Endpoint Configuration
- odysseus
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Ghost: Private IP filtering bypass to make server-side requests to internal services
- Server-side request forgery (SSRF)
- CWE-184
>=6.0.9, <6.21.1 · fixed in 6.21.1
GHSA-wvp2-4qqp-4h3r · CVE-2026-53944 - CVSS 7.5 High
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON
- CJCOLLIER Google::Auth
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Open WebUI: DNS Rebinding SSRF Bypass
- Race condition
- Server-side request forgery (SSRF)
<0.11.0 · fixed in 0.11.0
GHSA-h6x2-583h-x99r · CVE-2026-54020 - CVSS 7.1 High
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
- Server-side request forgery (SSRF)
>=0.9.0, <0.11.0 · fixed in 0.11.0
GHSA-8x5v-cpv7-8jjp · CVE-2026-70485 - CVSS 4.1 Medium
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
- Server-side request forgery (SSRF)
>=0.6.34, <0.11.0 · fixed in 0.11.0
GHSA-rffm-9q57-q649 · CVE-2026-70480 - CVSS 7.7 High
Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
- Server-side request forgery (SSRF)
>=0.9.6, <0.11.0 · fixed in 0.11.0
GHSA-w2rx-84hp-gg95 · CVE-2026-70479 - CVSS 8.7 High
Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
- Path traversal
- Server-side request forgery (SSRF)
<5.2.17 || >=6.0a1, <6.0.8 · fixed in 5.2.17, 6.0.8
GHSA-wvqv-fj8w-qmhm · CVE-2026-15307 - CVSS 7.5 High
Server-side request forgery in NVIDIA Dynamo
- NVIDIA Dynamo
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-side request forgery in NVIDIA Dynamo
- NVIDIA Dynamo
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-side request forgery in NVIDIA Dynamo
- NVIDIA Dynamo
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-side request forgery in NVIDIA Dynamo
- NVIDIA Dynamo
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-side request forgery in NVIDIA Dynamo
- NVIDIA Dynamo
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-side request forgery in NVIDIA Dynamo
- NVIDIA Dynamo
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
NousResearch hermes-agent Browser Tooling browser_tool.py browser_snapshot server-side request forgery
- NousResearch hermes-agent
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery
- NousResearch hermes-agent
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
- Server-side request forgery (SSRF)
- CWE-1389
<3.1.3 · fixed in 3.1.3
GHSA-c6xh-wv4j-ppv5 · CVE-2026-69257 - CVSS 5.4 Medium
Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services
- Mobi-Com Polska Sp. z o.o. stunnel
- Red Hat Enterprise Linux 10
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import
- Visualizer
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
EmbedPress < 4.6.1 - Unauthenticated Blind SSRF
- EmbedPress
- Server-side request forgery (SSRF)