Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.5 High
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 8.8 High
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Server-side request forgery (SSRF)
- CVSS 5.9 Medium
n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
- Server-side request forgery (SSRF)
<2.37.7 || >=2.38.0, <2.38.2 · fixed in 2.37.7, 2.38.2
GHSA-q5wm-mgqx-fv2f · CVE-2026-86074 - CVSS 5.3 Medium
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
- Server-side request forgery (SSRF)
<=19.2.25 || >=20.0.0, <20.3.30 || >=21.0.0, <21.2.22 || >=22.0.0, <22.1.4 · fixed in 20.3.30, 21.2.22, 22.1.4
GHSA-f6mr-pjwc-34m4 · CVE-2026-88056 - CVSS 8.5 High
Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent
- AWS Amazon SSM Agent
- Server-side request forgery (SSRF)
- CWE-1289
- CVSS 7.1 High
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
- Server-side request forgery (SSRF)
<1.123.76 || >=2.0.0, <2.37.7 || >=2.38.0, <2.38.2 · fixed in 1.123.76, 2.37.7, 2.38.2
GHSA-34ff-336r-5q23 · CVE-2026-86082 - CVSS 7.7 High
Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
- Race condition
- Server-side request forgery (SSRF)
>=0.9.6, <0.11.1 · fixed in 0.11.1
GHSA-4v28-j6q3-5m4r · CVE-2026-87996 - CVSS 7.1 High
Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch
- Server-side request forgery (SSRF)
<0.11.1 · fixed in 0.11.1
GHSA-34r3-9m95-vq73 · CVE-2026-87999 - CVSS 6.9 Medium
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
- espocrm
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch
- openpanel
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets
- Server-side request forgery (SSRF)
>=0.9.5, <0.11.1 · fixed in 0.11.1
GHSA-5x7x-4c3c-qf5w · CVE-2026-88001 - CVSS 8.8 High
Komari: Management Interface CSRF
- Server-side request forgery (SSRF)
<0.0.0-20260609084633-98122fa4d110 · fixed in 0.0.0-20260609084633-98122fa4d110
GHSA-hxjg-93wc-h8p8 - CVSS 7.8 High
GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool
- Server-side request forgery (SSRF)
>=4.4.0, <4.4.12 || >=4.0.0, <4.2.17 · fixed in 4.4.12, 4.2.17
GHSA-5hx7-j24v-rffj · CVE-2026-55864 - CVSS 6.2 Medium
weasyprint Has Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
<70.0 · fixed in 70.0
GHSA-jf6q-chmf-3h3v · CVE-2026-55073 - CVSS 5.5 Medium
LF Edge eKuiper: SSRF in External Service
- Server-side request forgery (SSRF)
<2.4.0 · fixed in 2.4.0
GHSA-pqqc-8v73-9gg2 · CVE-2025-24979 - CVSS 8.6 High
Server-side request forgery in Schneider Electric EcoStruxure™ IT Data Center Expert (Formerly known as…
- Schneider Electric EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert)
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num
- grokability snipe-it
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch
- laradashboard
- Server-side request forgery (SSRF)
- CVSS 7.3 High
Server-side request forgery in Dell Secure Connect Gateway 5.0 - Application and others
- Dell Secure Connect Gateway 5.0 - Application
- Dell Secure Connect Gateway 5.0 - Appliance
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Apache Impala: Secrets Exfiltration via SSRF
- Apache Software Foundation Apache Impala
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Apache Impala: Avro Schema URL Server-Side Request Forgery
- Apache Software Foundation Apache Impala
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SSRF in Yordam Informatics's Library Automation System
- Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program
- Server-side request forgery (SSRF)
- CVSS 7.3 High
Server-side request forgery in Dell Secure Connect Gateway 5.0 - Application and others
- Dell Secure Connect Gateway 5.0 - Application
- Dell Secure Connect Gateway 5.0 - Appliance
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Tanium addressed a server-side request forgery vulnerability in Enforce.
- Tanium Enforce
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
Server-side request forgery in Google Chrome
- Google Chrome
- Server-side request forgery (SSRF)
- CVSS 6.0 Medium
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
- Path traversal
- Server-side request forgery (SSRF)
<9.1.1 · fixed in 9.1.1
GHSA-8m3c-c648-2xjj · CVE-2026-92595 - CVSS 6.5 Medium
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
- Server-side request forgery (SSRF)
<0.26.0 · fixed in 0.26.0
GHSA-4hhp-h66f-j5j7 · CVE-2026-73560 - CVSS 6.9 Medium
opengeos GeoLibre _is_within_roots server-side request forgery
- opengeos GeoLibre
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Skype for Business Information Disclosure Vulnerability
- Microsoft Skype for Business Server 2015 CU13
- Microsoft Skype for Business Server 2019 CU8
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher
- Server-side request forgery (SSRF)
<1.29.1-0.20260804193351-8cf7ccd5ee04 · fixed in 1.29.1-0.20260804193351-8cf7ccd5ee04
GHSA-p2w3-6x73-2f6x · CVE-2026-73087 - CVSS 3.1 Low
InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning
- instantsoft icms2
- Server-side request forgery (SSRF)
- CVSS 3.5 Low
Microsoft Office SharePoint Information Disclosure Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Visual Studio Code Security Feature Bypass Vulnerability
- Microsoft Visual Studio Code
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Microsoft Office SharePoint Information Disclosure Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Microsoft Exchange Server Spoofing Vulnerability
- Microsoft Exchange Server 2016 Cumulative Update 23
- Microsoft Exchange Server 2019 Cumulative Update 14
- Server-side request forgery (SSRF)
- CVSS 8.7 High
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
- Server-side request forgery (SSRF)
- CWE-441
<3.10.3 · fixed in 3.10.3
GHSA-6ww7-3frv-cqxh · CVE-2026-78682 - CVSS 5.9 Medium
snipe-it before 8.7.0 SSRF via IPv6 transition address bypass
- grokability snipe-it
- Server-side request forgery (SSRF)
- CVSS 7.7 High
XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler
- XenForo
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Server-side request forgery in Eclipse Foundation Eclipse Che
- Eclipse Foundation Eclipse Che
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Request Forgery (SSRF) vulnerability
- John Darrel Hide My WP Ghost
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence
- SAP_SE SAP Manufacturing Integration and Intelligence
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint
- knowns
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
- Server-side request forgery (SSRF)
>=0.3.0, <0.3.1 · fixed in 0.3.1
GHSA-wprp-8gvj-p6cv · CVE-2026-82757 - CVSS 3.3 Low
Server-side request forgery in JetBrains IntelliJ IDEA
- JetBrains IntelliJ IDEA
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
java-json-tools jackson-coreutils URL Validation JsonLoader.java JsonLoader.fromURL server-side request forgery
- java-json-tools jackson-coreutils
- Server-side request forgery (SSRF)
- CVSS 7.0 High
MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosure via Feed Redirects and TAXII Discovery
- MISP
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery
- siga
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery
- liufee FeehiCMS
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
openagents-org openagents http.py test_default_model server-side request forgery
- openagents
- Server-side request forgery (SSRF)
- CVSS 9.0 CriticalCritical · CVSS 9+
OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
- THU-MAIC OpenMAIC
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 8.7 High
MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler
- mindsdb
- Server-side request forgery (SSRF)
- CVSS 9.4 CriticalCritical · CVSS 9+
SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints
- sqlchat
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server
- rowboat
- Server-side request forgery (SSRF)
- CVSS 9.2 CriticalCritical · CVSS 9+
Webstudio through 0.296.0 SSRF via /cgi proxy routes
- webstudio
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
- Elegant Themes Divi
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint
- Greenshift
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Camaleon CMS 2.7.5 through 2.9.1 SSRF via HTTP Redirect in Upload from URL
- owen2345 CamaleonCMS
- Server-side request forgery (SSRF)