Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.1 CriticalCritical · CVSS 9+
The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
- Server-side request forgery (SSRF)
>=2.4.0rc0, <2.12.0 · fixed in 2.12.0
GHSA-hvfh-5mj3-5f3j · CVE-2026-120492 - CVSS 7.1 High
Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address
- dradis-ce
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Campaign Classic
- Server-side request forgery (SSRF)
- CVSS 7.1 High
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
- Server-side request forgery (SSRF)
<1.1.4 · fixed in 1.1.4
GHSA-8cp3-qxj6-px34 - CVSS 5.3 Medium
utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
- Server-side request forgery (SSRF)
<1.1.1 · fixed in 1.1.1
GHSA-ppx3-28rw-8fpf · CVE-2026-12210 - CVSS 8.2 High
utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target
- Server-side request forgery (SSRF)
<1.1.4 · fixed in 1.1.4
GHSA-9qhg-99ww-9mqc - CVSS 3.5 Low
SSRF In CocoaPods Via JFrog Artifactory External Dependency
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
- jfrog artifactory
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
- Race condition
- Server-side request forgery (SSRF)
<4.6.58 · fixed in 4.6.58
GHSA-hmfx-4v44-9qw9 · CVE-2026-55535 - CVSS 7.1 High
PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
- Race condition
- Server-side request forgery (SSRF)
<4.6.58 · fixed in 4.6.58
GHSA-rg5q-pp8p-f7jm · CVE-2026-55537 - CVSS 6.4 Medium
Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction
- Red Hat Ansible Automation Platform 2
- Server-side request forgery (SSRF)
- CVSS 7.5 High
praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)
- Race condition
- Server-side request forgery (SSRF)
<1.6.58 · fixed in 1.6.58
GHSA-vg6p-v9vm-6fgj · CVE-2026-55524 - CVSS 8.5 High
praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
- Server-side request forgery (SSRF)
- CWE-350
<1.6.58 · fixed in 1.6.58
GHSA-x44h-65qv-cw74 · CVE-2026-55526 - CVSS 7.7 High
praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets
- Server-side request forgery (SSRF)
>=1.5.128, <1.6.58 · fixed in 1.6.58
GHSA-8hjw-25cg-g52h · CVE-2026-55523 - CVSS 7.5 High
praisonaiagents web_crawl vulnerable to SSRF via redirect-following
- Server-side request forgery (SSRF)
<1.6.58 · fixed in 1.6.58
GHSA-5r34-2g38-6569 · CVE-2026-55525 - CVSS 9.1 CriticalCritical · CVSS 9+
Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url
- Apache Software Foundation Apache Hive
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Duplicate Advisory: pathsec SSRF protection can be bypassed when a proxy is configured
- Server-side request forgery (SSRF)
<=3.10.2 · no fixed version yet
GHSA-crp9-r7rq-c8cg - CVSS 6.9 Medium
Adminer before 5.5.0 SSRF via PDO DSN Injection
- vrana adminer
- Server-side request forgery (SSRF)
- CVSS 8.4 High
Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects
- HiEventsDev Hi.Events
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Awx: notification backends allow ssrf and credential leakage
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Server-side request forgery (SSRF)
- CVSS 8.2 High
RansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access
- ransomlook
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability
- WP ManageNinja LLC FluentCRM Pro
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability
- Tammersoft Shared Files
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation
- hugo
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space
- BentoML
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
vas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery
- vas3k TaxHacker
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Duplicate Advisory: nltk: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
- Server-side request forgery (SSRF)
<=3.9.4 · no fixed version yet
GHSA-qg9p-xrhj-435m - CVSS 9.8 CriticalCritical · CVSS 9+
Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys
- Mailgun for WordPress
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers
- Server-side request forgery (SSRF)
<7.5.2 || >=7.6.0, <7.6.5 || >=8.0.0, <8.0.2 · fixed in 7.5.2, 7.6.5, 8.0.2
GHSA-5vf6-jrqr-78fj · CVE-2026-63004 - CVSS 8.3 High
OpenViking < 0.3.4 SSRF via /api/v1/resources
- Volcengine OpenViking
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Azure SQL Database Elevation of Privilege Vulnerability
- Microsoft Azure SQL Database
- Server-side request forgery (SSRF)
- CVSS 2.7 Low
Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
- Eventin
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation
- Headroom
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Apache CloudStack: RCE and SSRF in direct download, metalink and NFS templates
- Apache Software Foundation Apache CloudStack
- Command injection
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module
- Apache Software Foundation Apache CloudStack
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Apache CloudStack: Authenticated pre-validation SSRF in registerTemplate
- Apache Software Foundation Apache CloudStack
- Server-side request forgery (SSRF)
- CVSS 2.2 Low
Server-side request forgery in OpenStack Glance
- OpenStack Glance
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Server Side Request Forgery (SSRF) vulnerability reported in Windchill
- PTC Windchill PDMLink
- PTC FlexPLM
- Insecure deserialization
- Server-side request forgery (SSRF)
- CVSS 7.7 High
langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery
- langchain-ai langchain-community
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery
- lightdash
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Microsoft Copilot in Azure Information Disclosure Vulnerability
- Microsoft Copilot in Azure
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Azure Virtual Machines Elevation of Privilege Vulnerability
- Microsoft Azure Virtual Machines
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Azure Data Factory Information Disclosure Vulnerability
- Microsoft Azure Data Factory
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution
- mauriceboe TREK
- Server-side request forgery (SSRF)
- CVSS 9.9 CriticalCritical · CVSS 9+
Microsoft Entra ID Elevation of Privilege Vulnerability
- Microsoft Entra
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Microsoft Exchange Online Elevation of Privilege Vulnerability
- Microsoft Exchange Online
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable
- decolua 9router
- Server-side request forgery (SSRF)
- CWE-184
- CVSS 5.3 Medium
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
- Server-side request forgery (SSRF)
- CWE-20
<0.9.0a11 · fixed in 0.9.0a11
GHSA-5p3m-vhh6-9236 · CVE-2026-76239 - CVSS 5.4 Medium
Apache InLong: Authenticated SSRF via POST /api/node/testConnection
- Apache Software Foundation Apache InLong
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Server-Side Request Forgery in ATutor
- ATutor
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool
- n8n
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
n8n before 1.123.69 SSRF Protection Bypass via OAuth2
- n8n
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation
- omnivore
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query
- omnivore
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery
- AeternaLabsHQ PullMD
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Server-Side Request Forgery (SSRF) through the REST API in Splunk Connect for Kafka
- Splunk Connect for Kafka
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Server-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud
- Splunk Cisco Talos Intelligence for Enterprise Security Cloud
- Server-side request forgery (SSRF)
- CVSS 2.7 Low
Server-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR
- Splunk SOAR
- Server-side request forgery (SSRF)