Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass
- Metabase
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Nango through 0.70.4 Server-Side Request Forgery via Configuration
- Nango
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin
- coze-dev coze-studio
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Graylog through 7.1.4 Server-Side Request Forgery via HTTP Redirect
- graylog2-server
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch
- requarks Wiki.js
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery
- chatwoot
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise
- Altium Enterprise Server
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Tanium addressed a server-side request forgery vulnerability in Threat Response.
- Tanium Threat Response
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability
- Apache Software Foundation Apache MyFaces
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Quickwit through 0.9.0 SSRF via SQS queue_url Parameter
- quickwit
- Server-side request forgery (SSRF)
- CVSS 7.1 High
TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL
- TDuckCloud tduck-survey-form
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Hippo4j through 1.5.0 SSRF via clientAddress Parameter
- opengoofy hippo4j
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
MLRun through 1.11.0 Server-Side Request Forgery via Webhook
- mlrun
- Server-side request forgery (SSRF)
- CVSS 8.8 High
DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
- datagear
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery
- WuzhiCMS
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Server-side request forgery in Jenkins Project Jenkins Bitbucket Push and Pull Request Plugin
- Jenkins Project Jenkins Bitbucket Push and Pull Request Plugin
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling
- WP Import Export Lite
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery
- a2ui
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery
- ag-ui
- Server-side request forgery (SSRF)
- CVSS 9.6 CriticalCritical · CVSS 9+
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery
- Server-side request forgery (SSRF)
>=0.0.1, <2.1.27 · fixed in 2.1.27
GHSA-2h44-8472-frjj · CVE-2026-61559 - CVSS 7.2 High
Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints
- ShaneIsrael fireshare
- Server-side request forgery (SSRF)
- CVSS 2.1 Low
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports
- Concrete CMS
- Server-side request forgery (SSRF)
- CVSS 7.7 High
OpenCTI: Synchronizer SSRF: stream fetch has no URL validation
- opencti
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Authenticated Server-Side Request Forgery Vulnerabilities Leading to Information Disclosure in EdgeConnect SD-WAN Orchestrator
- Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways
- Server-side request forgery (SSRF)
- CVSS 4.0 Medium
Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability
- Fabric.js
- Server-side request forgery (SSRF)
- CVSS 9.0 CriticalCritical · CVSS 9+
SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts
- Server-side request forgery (SSRF)
- CWE-636
>=0.1.0 · no fixed version yet
EEF-CVE-2026-77866 · CVE-2026-77866 - CVSS 5.3 Medium
AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
AVideo through 29.0 Unauthenticated SSRF via Host Header
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy
- unclecode crawl4ai
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Flowise before 3.1.4 Server-Side Request Forgery via document loaders
- Flowise
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes
- Flowise
- Server-side request forgery (SSRF)
- CVSS 8.3 High
KubeSphere through 4.1.3 SSRF via git credential verification endpoint
- kubesphere
- Server-side request forgery (SSRF)
- CVSS 7.1 High
WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects
- Tencent WeKnora
- Server-side request forgery (SSRF)
- CVSS 8.1 High
An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint
- refly
- Server-side request forgery (SSRF)
- CVSS 9.6 CriticalCritical · CVSS 9+
Incomplete Security Scanner Blocklist Enables Network-Based Code Execution
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
netease-youdao LobsterAI Browser Network Configuration openclawConfigSync.ts OpenClawConfigSync.buildBrowserConfig server-side request forgery
- netease-youdao LobsterAI
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery
- cosmicstack-labs mercury-agent
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint
- suitenumerique docs
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Huly Platform through 0.7.426 SSRF via Print Service
- hcengineering platform
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
October CMS: Incomplete Scheme Validation in Image Resizer
- Server-side request forgery (SSRF)
- CWE-20
>=4.3.0, <4.3.5 · fixed in 4.3.5
GHSA-2xmm-m4wv-3fjh · CVE-2026-100909 - CVSS 5.3 Medium
a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery
- a2aproject a2a-python
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
taisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery
- taisan tarzan-cms
- Server-side request forgery (SSRF)
- CVSS 7.0 High
Server-side request forgery in OpenStack Glance
- OpenStack Glance
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
- Flowise
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Open Notebook before 1.11.0 Server-Side Request Forgery via link-source
- lfnovo open-notebook
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery
- openstatus
- Server-side request forgery (SSRF)
- CVSS 8.5 High
FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
- Server-side request forgery (SSRF)
>=1.2.1, <1.5.0 · fixed in 1.5.0
GHSA-65h7-9wrw-629c · CVE-2026-59973 - CVSS 5.3 Medium
Server-Side Request Forgery in Malcolm
- CISA Malcolm
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass
- Shelf-nu shelf.nu
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
WWBN AVideo Unauthenticated SSRF via login.json.php
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 8.7 High
SSRF in Gemini Enterprise Agent Platform App Builder
- Google Cloud Gemini Enterprise Agent Platform App Builder
- Server-side request forgery (SSRF)
- CVSS 7.2 High
mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url
- Path traversal
- Server-side request forgery (SSRF)
<0.8.18 · fixed in 0.8.18
GHSA-wfgq-w7cq-qj7j - CVSS 6.5 Medium
Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects
- transmute
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- IBM Langflow OSS
- Server-side request forgery (SSRF)