Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.6 High
heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes
- heym
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist
- AzuraCast
- Server-side request forgery (SSRF)
- CVSS 7.1 High
AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs
- AzuraCast
- Server-side request forgery (SSRF)
- CVSS 7.1 High
AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL
- AzuraCast
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Kyverno before 1.19.1 SSRF via legacy apiCall service executor
- kyverno
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex
- vrana adminer
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver
- vrana adminer
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver
- vrana adminer
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
- budibase server
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
ClawHub SSRF via Unchecked DNS Resolution in Profile Image
- openclaw clawhub
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL
- Testimonials Widget
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
OpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset
- OpenClaw
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
OpenClaw before 2026.8.1 SSRF via Browser Wait Predicates
- OpenClaw
- Server-side request forgery (SSRF)
- CVSS 8.2 High
OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS
- OpenClaw
- Server-side request forgery (SSRF)
- CVSS 8.9 High
OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname
- OpenClaw
- Server-side request forgery (SSRF)
- CVSS 7.1 High
OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
- OpenClaw
- Server-side request forgery (SSRF)
- CVSS 8.8 High
MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation
- mhdzumair mediaflow-proxy
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass
- open-metadata OpenMetadata
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Zammad: Avatar Image URL Server-Side Request Forwarding
- zammad
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter
- gabelivan Asset CleanUp: Page Speed Booster
- Server-side request forgery (SSRF)
- CVSS 4.0 Medium
Link Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation
- Link Library
- Server-side request forgery (SSRF)
- CVSS 8.1 High
An issue in the VMware datastore driver of OpenStack glance_store.
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance.
- Server-side request forgery (SSRF)
- CVSS 3.1 Low
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
- Server-side request forgery (SSRF)
>=5.3.35, <5.3.48 || >=5.4.0, <5.7.9 · fixed in 5.3.48, 5.7.9
GHSA-87mg-5grr-rhwh · CVE-2026-57232 - CVSS 6.9 Medium
songxinjianqwe Chat chat-server ChatServer.java server-side request forgery
- songxinjianqwe Chat
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
YunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery
- YunaiV ruoyi-vue-pro
- zhijiantianya ruoyi-vue-pro
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)
- TREK
- Server-side request forgery (SSRF)
- CVSS 8.1 High
TREK: Server-Side Request Forgery via User-Configurable LLM Base URL
- mauriceboe TREK
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist
- Termix
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Termix: Authenticated blind SSRF through notification channel test endpoints
- Termix
- Server-side request forgery (SSRF)
- CVSS 8.6 High
BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass
- alam00000 bentopdf
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint
- logto
- Server-side request forgery (SSRF)
- CVSS 9.6 CriticalCritical · CVSS 9+
DataStage on Cloud Pak for Data has several vulnerabilities
- IBM DataStage on Cloud Pak for Data
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Server-side request forgery (SSRF)
- CVSS 8.8 High
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions
- Code injection
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)
- Red Hat Ansible Automation Platform 2.7
- Red Hat Ansible Automation Platform 2
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
- Broken access control
- Server-side request forgery (SSRF)
<2.2.23 || >=3.0.0, <3.1.31 · fixed in 2.2.23, 3.1.31
GHSA-v3f3-cmj4-cvj9 · CVE-2026-76086 - CVSS 6.4 Medium
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
- Server-side request forgery (SSRF)
- CWE-20
<0.5.6 · fixed in 0.5.6
GHSA-6mwv-4mrm-5p3m · CVE-2026-56678 - CVSS 7.4 High
9router: Image prefetch DNS rebinding allows SSRF to internal services
- Race condition
- Server-side request forgery (SSRF)
<0.5.2 · fixed in 0.5.2
GHSA-cmhj-wh2f-9cgx · CVE-2026-56676 - CVSS 5.3 MediumCritical · KEVKEV
Plex Media Server arbitrary-host SSRF
- Plex Media Server
- Server-side request forgery (SSRF)
- CVSS 5.3 MediumCritical · KEVKEV
Plex Media Server SSRF
- Plex Media Server
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
SSRF Leading to JWT Token Disclosure in Global IT Informatics' Weoll
- Global IT Informatics Technology Services Inc. Weoll
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL
- Directorist: AI-Powered Business Directory, Listings & Classified Ads
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
iFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery
- iFlytek astron-agent
- Server-side request forgery (SSRF)
- CVSS 7.9 High
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- IBM Financial Transaction Manager (FTM) for RedHat OpenShift
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Multiple Vulnerabilities in IBM Concert Software
- IBM Concert
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery
- GitHub Enterprise Server
- Server-side request forgery (SSRF)
- CWE-208
- CVSS 5.4 Medium
Home Assistant: mDNS Server-Side Request Forgery
- Server-side request forgery (SSRF)
<2026.2.3 · fixed in 2026.2.3
GHSA-4ghv-53cq-7wp3 · CVE-2026-91129 - CVSS 6.5 Medium
Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses
- Server-side request forgery (SSRF)
- CWE-697
<4.0.0-20260715072853-1c5cad6dec7e · fixed in 4.0.0-20260715072853-1c5cad6dec7e
GHSA-jvh5-97xg-v99f · CVE-2026-79913 - CVSS 7.1 High
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
- Server-side request forgery (SSRF)
<1.5.5 · fixed in 1.5.5
GHSA-vv3m-f8x4-7377 · CVE-2026-85740 - CVSS 5.3 Medium
MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup
- Server-side request forgery (SSRF)
<0.22.0 · fixed in 0.22.0
GHSA-v9m3-wfh8-5646 · CVE-2026-77249 - CVSS 8.8 High
MCP Atlassian: SSRF Protection Bypass
- Server-side request forgery (SSRF)
<0.22.0 · fixed in 0.22.0
GHSA-hgcf-4mq8-5266 · CVE-2026-77274 - CVSS 8.3 High
mcp-atlassian has an incomplete SSRF remediation
- Server-side request forgery (SSRF)
<0.22.0 · fixed in 0.22.0
GHSA-5wf4-jqxh-8gm3 · CVE-2026-77267 - CVSS 7.1 High
MCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches
- Server-side request forgery (SSRF)
<0.22.0 · fixed in 0.22.0
GHSA-6529-c226-h328 · CVE-2026-77261 - CVSS 5.9 Medium
MCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow
- Server-side request forgery (SSRF)
<0.22.0 · fixed in 0.22.0
GHSA-49xv-9743-pw8w · CVE-2026-77265 - CVSS 5.5 Medium
Mattermost server-side request forgery via OAuth endpoints configurable by a System Administrator
- Mattermost
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
- Server-side request forgery (SSRF)
<0.91.1 · fixed in 0.91.1
GHSA-fjwv-jf2v-j499 · CVE-2026-61681 - CVSS 6.5 Medium
OpenCVE: Server-Side Request Forgery (SSRF) in notifications
- Server-side request forgery (SSRF)
<3.0.0 · fixed in 3.0.0
GHSA-ch3g-4xvr-674q · CVE-2026-62282 - CVSS 7.1 High
Premiere Pro | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Premiere
- Server-side request forgery (SSRF)