Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.2 High
WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability
- Jegstudio Gutenverse Companion
- Server-side request forgery (SSRF)
- CVSS 6.0 Medium
WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability
- TangibleWP Vehica Core
- Server-side request forgery (SSRF)
- CVSS 8.4 High
Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses
- s9y Serendipity
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Meeting Room Booking System has server-side request forgery in import functionality
- meeting-room-booking-system mrbs-code
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
- AWS Opensearch
- Github Opensearch
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation
- microsoft UFO
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
WhatsUp Gold versions prior to 26.0.2 contain an unauthenticated remote code execution vulnerability in an internal report scheduling service.
- Progress Software Corporation WhatsUp Gold
- Path traversal
- Code injection
- CVSS 8.6 High
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
- Server-side request forgery (SSRF)
- CWE-184
<4.1.0 · fixed in 4.1.0
GHSA-h47f-gmjp-m7rr · CVE-2026-52776 - CVSS 5.1 Medium
Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup
- vulnerability-lookup
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider
- prowler
- Server-side request forgery (SSRF)
- CVSS 3.4 Low
Server-side request forgery in Fortinet FortiSIEM
- Fortinet FortiSIEM
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
ProSolution WP Client < 2.0.9 - Subscriber+ SSRF via proSol_url_validate
- ProSolution WP Client
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL
- PowerPress Podcasting plugin by Blubrry
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler
- baptisteArno typebot.io
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass
- kekingcn kkFileView
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability
- Server-side request forgery (SSRF)
- CWE-693
>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11
GHSA-9mrh-pw7c-9mqm · CVE-2026-62902 - CVSS 5.8 Medium
coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE
- coturn
- Broken access control
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Microsoft SharePoint Server Spoofing Vulnerability
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Microsoft SharePoint Server Elevation of Privilege Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Microsoft SharePoint Elevation of Privilege Vulnerability
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Microsoft Exchange Server Elevation of Privilege Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Server-side request forgery (SSRF)
- CVSS 7.4 High
PowerShell Information Disclosure Vulnerability
- Microsoft PowerShell 7.4
- Microsoft PowerShell 7.5
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Allura: Server-side request forgery
- Apache Software Foundation Apache Allura
- Server-side request forgery (SSRF)
- CVSS 4.7 Medium
CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Content Credentials Rust SDK
- Adobe Content Credentials Command-Line Tool
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Activepieces: Server-side request forgery in MCP tool validation endpoint
- activepieces
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server
- baptisteArno typebot.io
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
- Server-side request forgery (SSRF)
<0.0.0-20260512171120-69da20bdaec9 · fixed in 0.0.0-20260512171120-69da20bdaec9
GHSA-87fv-vqqr-m4jr · CVE-2026-73080 - CVSS 5.1 Medium
Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture
- Lookyloo PlaywrightCapture
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation
- cms
- Server-side request forgery (SSRF)
- CVSS 7.4 High
Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Server-side request forgery (SSRF)
- CVSS 7.4 High
Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Pinry Pinry - Server-Side Request Forgery
- Pinry
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Apioo Fusio - Server-Side Request Forgery
- Apioo Fusio
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Friendica Friendica - Server-Side Request Forgery
- Friendica
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
HumanSignal Label Studio - Server-Side Request Forgery
- HumanSignal Label Studio
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Dub Dub - Server-Side Request Forgery
- Dub
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Server-Side Request Forgery (SSRF)
- Commvault Cloud
- Server-side request forgery (SSRF)
- CVSS 8.7 High
cti-transmute Unauthenticated SSRF via Hostnames Resolving to Internal IP Addresses
- MISP cti-transmute
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
CVE-2026-19516 CVE Record
- Grafana MCP Server
- mcp-grafana
- Server-side request forgery (SSRF)
- CVSS 8.5 High
An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery (SSRF) via the Webhook validation mechanism in internal/webhook/validate.go, by sett…
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses
- mastodon
- Server-side request forgery (SSRF)
- CWE-1286
- CVSS 6.9 Medium
Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup
- vulnerability-lookup
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Koito - Authenticated Server-Side Request Forgery via Album Image URL Parameter
- gabehf Koito
- Server-side request forgery (SSRF)
- CVSS 8.6 High
duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint
- duhow xiaoai-patch
- Server-side request forgery (SSRF)
- CVSS 7.7 High
automatisch - Server-Side Request Forgery via HTTP Request Custom Action
- automatisch
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter
- All-in-One Video Gallery
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery
- Podcast Player
- Server-side request forgery (SSRF)
- CVSS 2.2 Low
LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature
- LearnPress
- Server-side request forgery (SSRF)
- CVSS 3.7 Low
A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by...
- Server-side request forgery (SSRF)
<=3.9.4 · no fixed version yet
GHSA-2jhm-w3mp-jcwr · CVE-2026-12372 - CVSS 5.3 Medium
dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery
- dmitriiweb article-scraper-mcp
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery
- adafap api-mcp
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery
- PhialsBasement KoboldCPP-MCP-Server
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get server-side request forgery
- KS-GEN-AI jira-mcp-server
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
NocteDefensor LudusMCP read_range_config rangeConfig.ts server-side request forgery
- NocteDefensor LudusMCP
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery
- mifi lossless-cut
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery
- anubissbe ProjectHub-Mcp
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
aliyun alibabacloud-dataworks-mcp-server initResources.ts ReadResourceRequestSchema server-side request forgery
- aliyun alibabacloud-dataworks-mcp-server
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
adenot mcp-google-search read_webpage index.ts server-side request forgery
- adenot mcp-google-search
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List
- Flowise
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery
- HKUDS nanobot
- Server-side request forgery (SSRF)