Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.2 High
Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`
- ellite Wallos
- Server-side request forgery (SSRF)
- CWE-441
- CVSS 3.5 Low
Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings
- ellite Wallos
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Wallos: SSRF via OIDC Token/UserInfo URL Configuration
- ellite Wallos
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port
- ellite Wallos
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability
- MapSVG
- Server-side request forgery (SSRF)
- CVSS 8.6 High
elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback
- Server-side request forgery (SSRF)
<2.1.70 · fixed in 2.1.70
GHSA-8x3q-jpjh-qh5c · CVE-2026-81889 - CVSS 5.3 Medium
sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery
- sdcb chats
- Server-side request forgery (SSRF)
- CVSS 8.3 High
oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs
- oasdiff-action
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 7.1 High
MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)
- samanhappy mcphub
- Server-side request forgery (SSRF)
- CVSS 7.6 High
MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation
- samanhappy mcphub
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery
- NASA earthdata-search
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery
- NASA earthdata-search
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery
- yaojingang GEOFlow
- Server-side request forgery (SSRF)
- CVSS 5.9 Medium
Apache Shiro: Server-side POST request may be steered to an alternate host
- Apache Software Foundation Apache Shiro
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery
- PowerJob
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery
- Forgejo
- Server-side request forgery (SSRF)
- CVSS 8.7 High
jina-ai reader Server-Side Request Forgery via disabled private-address guard
- jina-ai reader
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
- memos
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Server-side request forgery in MITRE Heimdall
- MITRE Heimdall
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password
- 爱采集数据采集和发布插件
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure
- Total processing card payments for WooCommerce
- Server-side request forgery (SSRF)
- CVSS 7.7 High
SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image
- SmartAIPress
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 8.2 High
9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
- Authentication bypass
- Server-side request forgery (SSRF)
<0.5.2 · fixed in 0.5.2
GHSA-86m2-fcxq-5q7c · CVE-2026-55641 - CVSS 8.7 High
Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL
- Server-side request forgery (SSRF)
<1.5.17 · fixed in 1.5.17
GHSA-w98g-5w9p-p3rc · CVE-2026-55245 - CVSS 8.3 High
Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure
- coderamp-labs gitingest
- Server-side request forgery (SSRF)
- CVSS 8.8 High
BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback
- dataelement bisheng
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/*
- Portkey-AI gateway
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Qwen-Agent Server-Side Request Forgery via Caller-Supplied Document URL
- QwenLM Qwen-Agent
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Logto Server-Side Request Forgery via OIDC SSO Connector Issuer URL
- logto
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Logto Server-Side Request Forgery via webhook test endpoint
- logto
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true
- kubeflow pipelines
- Broken access control
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Budibase Server before 3.41.3 SSRF via Query Import
- budibase server
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Budibase Server before 3.41.3 SSRF with Credential Leakage
- budibase server
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Budibase backend-core SSRF via incomplete default blacklist
- budibase server
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Server-side request forgery in Synology Chat Server
- Synology Chat Server
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Server-side request forgery in wallabag
- wallabag
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Dimension Server-Side Request Forgery via Email Server Test Settings
- WatchGuard Dimension
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Dimension Server-Side Request Forgery via Remote Backup Connection Test
- WatchGuard Dimension
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Dimension SSRF via FTP Server Test Connection
- WatchGuard Dimension
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Dimension Blind SSRF via Database Test Connection Feature
- WatchGuard Dimension
- Server-side request forgery (SSRF)
- CWE-208
- CVSS 5.1 Medium
cyberchitta scrapling-fetch-mcp _fetcher.py s_fetch_pattern server-side request forgery
- cyberchitta scrapling-fetch-mcp
- Server-side request forgery (SSRF)
- CVSS 2.0 Low
Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function
- Spring Cloud Function
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 8215 NAT64 prefix (64:ff9b:1::/96) bypasses SSRF protection
- CC-Tweaked
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Server-Side Request Forgery (SSRF) in GitLab AI Gateway
- GitLab AI Gateway
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Server-Side Request Forgery (SSRF) in GitLab AI Gateway
- GitLab AI Gateway
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
AVideo SSRF Guard Bypass via IPv6 Transition Addresses
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton
- apify actors-mcp-server
- Server-side request forgery (SSRF)
- CVSS 8.7 High
mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL
- mcp-use
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
In Spring for Apache Kafka, SSRF via DNS resolution triggered by untrusted java.net types in header mapper default trusted packages
- Spring for Apache Kafka
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Spring Cloud Gateway SSRF and native file access with gRPC
- Spring Cloud Gateway
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
- Spring Integration
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery
- ddfourtwo sentry-selfhosted-mcp
- Server-side request forgery (SSRF)
- CVSS 3.7 Low
HCL Connections is vulnerable to server-side request forgery (SSRF)
- HCLSoftware Connections
- Server-side request forgery (SSRF)
- CVSS 3.5 Low
Weblate: DNS rebinding in VCS operations allows server-side request forgery
- weblate
- Race condition
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Server-side request forgery in Dell Cloud Disaster Recovery
- Dell Cloud Disaster Recovery
- Server-side request forgery (SSRF)
- CVSS 7.1 High
OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL
- OneUptime
- Server-side request forgery (SSRF)
- CVSS 8.7 High
mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets
- kazuph mcp-fetch
- Server-side request forgery (SSRF)