Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.2 CriticalCritical · CVSS 9+
CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning
- Server-side request forgery (SSRF)
>=0.8.41, <0.8.64 · fixed in 0.8.64
GHSA-6v2g-fpxh-pmmh · CVE-2026-75856 - CVSS 5.0 Medium
Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 7.7 High
IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation
- IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`)
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 8.2 High
IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint
- IBM ContextForge MCP Gateway
- Server-side request forgery (SSRF)
- CVSS 8.7 High
jina-ai reader server-side request forgery via redirect validation bypass
- jina-ai reader
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Nightingale 9.1.1 SSRF Guard Bypass via IPv6 Encoding
- ccfos nightingale
- Server-side request forgery (SSRF)
- CVSS 8.7 High
MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url
- The-Vibe-Company megaparse
- Server-side request forgery (SSRF)
- CVSS 8.7 High
ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs
- modelscope ms-swift
- Server-side request forgery (SSRF)
- CVSS 8.7 High
OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching
- camel-ai owl
- Server-side request forgery (SSRF)
- CVSS 8.7 High
LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding
- hiyouga LlamaFactory
- Server-side request forgery (SSRF)
- CVSS 8.7 High
ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url
- ogx
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Marqo 2.26.0 Server-Side Request Forgery via Media URLs
- marqo
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter
- Evil0ctal Douyin_TikTok_Download_API
- Server-side request forgery (SSRF)
- CVSS 9.2 CriticalCritical · CVSS 9+
OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker
- openpanel
- Server-side request forgery (SSRF)
- CVSS 8.7 High
OpenPanel before 2.3.0 SSRF via favicon and og endpoints
- openpanel
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Openpanel before 2.3.0 SSRF via Site Checker Endpoint
- openpanel
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Snowflake JDBC Driver auto-configuration account validation permits credential redirection
- Snowflake JDBC Driver
- Snowflake JDBC Driver (FIPS)
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Allura: Server-side request forgery
- Apache Software Foundation Apache Allura
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Missing authentication in ASUS Control Center Enterprise (ACC)
- ASUS Control Center Enterprise (ACC)
- Authentication bypass
- Hard-coded credentials
- CVSS 6.9 Medium
light0011 cms UEditor controller.php catchimage server-side request forgery
- light0011 cms
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Power Automate Elevation of Privilege Vulnerability
- Microsoft Power Platform
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
unstructured: Server-Side Request Forgery in the URL-based partitioning
- Open redirect
- Server-side request forgery (SSRF)
>=0.4.7, <0.24.0 · fixed in 0.24.0
GHSA-4mvj-m6j5-pmf7 · CVE-2026-71428 - CVSS 5.4 Medium
WordPress SEOPress plugin <= 10.1 - Server Side Request Forgery (SSRF) vulnerability
- SEOPress
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability
- LiteSpeed Technologies LiteSpeed Cache
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
- Lookyloo PlaywrightCapture
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing
- SUSE Fleet
- Server-side request forgery (SSRF)
- Code injection
- CVSS 8.7 High
Ollama 0.30.0 through 0.33.2 SSRF via Cross-Host Tensor Blob Redirect
- ollama
- Server-side request forgery (SSRF)
- CVSS 8.4 High
Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL
- HumanSignal label-studio
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery
- NousResearch hermes-agent
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
- n8n
- Server-side request forgery (SSRF)
- CVSS 7.1 High
WWBN AVideo Server-Side Request Forgery via set_api_userImages
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 7.1 High
AVideo Server-Side Request Forgery via epg_link parameter
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
- OCS Inventory NG Ocsreports
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
Server-side request forgery in Dell PowerProtect Data Manager
- Dell PowerProtect Data Manager
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Plate: SSRF with response disclosure in DOCX image embedding
- Server-side request forgery (SSRF)
<53.3.2 · fixed in 53.3.2
GHSA-4q39-2jhr-7qx8 · CVE-2026-65842 - CVSS 7.5 High
link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897
- Server-side request forgery (SSRF)
<4.0.4 · fixed in 4.0.4
GHSA-cpjf-6666-r8fx · CVE-2026-61704 - CVSS 6.8 Medium
Open edX Platform: SSRF in Studio Video Download Endpoint
- openedx-platform
- Server-side request forgery (SSRF)
- CVSS 7.5 High
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
- Server-side request forgery (SSRF)
- CWE-20
>=2.3.1, <2.4.5 || >=3.0.0, <3.1.6 || >=4.0.0, <4.1.3 · fixed in 2.4.5, 3.1.6, 4.1.3
GHSA-f65p-4m7j-42xc · CVE-2026-75975 - CVSS 7.5 High
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
- Server-side request forgery (SSRF)
- CWE-174
>=2.4.1, <2.4.5 || >=3.1.2, <3.1.6 || >=4.0.0, <4.1.3 · fixed in 2.4.5, 3.1.6, 4.1.3
GHSA-fph4-wmhf-6fwf · CVE-2026-75899 - CVSS 8.7 High
BIG-IP and BIG-IQ Configuration utility vulnerability
- F5 BIG-IP
- F5 BIG-IQ
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure
- Server-side request forgery (SSRF)
<3.10.0 · fixed in 3.10.0
GHSA-3gqm-fcw5-w839 · CVE-2026-63311 - CVSS 7.1 High
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
- Path traversal
- Server-side request forgery (SSRF)
<8.22.0 · fixed in 8.22.0
GHSA-cxq5-97v7-87j8 · CVE-2026-62680 - CVSS 5.3 Medium
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
- Server-side request forgery (SSRF)
- CWE-20
<0.4.112 · fixed in 0.4.112
GHSA-83x6-42hr-jc76 · CVE-2026-73845 - CVSS 5.3 Medium
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
- Drupal Entity Share Websub
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability
- WPMU DEV Broken Link Checker
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Server-side request forgery in Eclipse Foundation Eclipse Ditto
- Eclipse Foundation Eclipse Ditto
- Denial of service
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix
- axllent mailpit
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal services
- GitHub Enterprise Server
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token
- GitHub Enterprise Server
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · KEV, CVSS 9+KEV
Server-side request forgery in SonicWall SMA1000
- SonicWall SMA1000
- Server-side request forgery (SSRF)
- CWE-441
- CVSS 6.4 Medium
Authenticated Server-Side Request Forgery (SSRF) Leading to Information Disclosure in AOS-CX
- Hewlett Packard Enterprise (HPE) AOS-CX
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Wyoming < 1.10.2 SSRF via uri Query Parameter
- OHF-Voice wyoming
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Smarty: SSRF via redirect bypass of trusted_uri using {fetch}
- Server-side request forgery (SSRF)
<4.5.7 || >=5.0.0, <5.8.2 · fixed in 4.5.7, 5.8.2
GHSA-cq55-c7wv-pxmq · CVE-2026-62993 - CVSS 5.3 Medium
Heym before 0.0.98 SSRF via WebSocket endpoints
- heym
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery
- invoiceninja Invoice Ninja
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery
- firefly
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)
- ellite Wallos
- Server-side request forgery (SSRF)