Advisories · Weakness

Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-82000 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe AEM 6.5 Forms JEE
- Adobe AEM 6.5 LTS Forms JEE
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-81999 CVE record

CVSS 8.7 High

Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe AEM 6.5 Forms JEE
- Adobe AEM 6.5 LTS Forms JEE
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-77242 CVE record

CVSS 7.5 High

MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)
- sooperset mcp-atlassian
- Race condition
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-83660 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Campaign Classic
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-82013 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Campaign Classic
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-82443 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Campaign Classic
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-95656 CVE record

CVSS 6.9 Medium

dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery
- dgtlmoon changedetection.io
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-84301 CVE record

CVSS 6.3 Medium

FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests
- labring FastGPT
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-75511 CVE record

CVSS 5.3 Medium

Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs
- novu
- @novu api-service
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-80150 CVE record

CVSS 7.7 High

Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter
- LANTRONIX SLC8000
- LANTRONIX EMG8500
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-80149 CVE record

CVSS 7.7 High

Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter
- LANTRONIX SLC8000
- LANTRONIX EMG8500
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-80148 CVE record

CVSS 7.7 High

Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation
- LANTRONIX SLC8000
- LANTRONIX EMG8500
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
@aborruso/ckan-mcp-server npm

CVSS 5.7 Medium

@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
- Server-side request forgery (SSRF)
<0.4.108 · fixed in 0.4.108

GHSA-798p-78g2-v556 · CVE-2026-61612 Not analysed yet 22 Sept 2026
CVE-2026-95679 CVE record

CVSS 6.9 Medium

MISP Unauthenticated Blind SSRF via XML Body Processing
- MISP
- Server-side request forgery (SSRF)
- CWE-20
Not analysed yet 22 Sept 2026
CVE-2026-95623 CVE record

CVSS 5.6 Medium

Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
- tauri-plugin-http
- Server-side request forgery (SSRF)
Not analysed yet 22 Sept 2026
CVE-2026-77522 CVE record

CVSS 4.3 Medium

MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)
- 1Panel-dev MaxKB
- Server-side request forgery (SSRF)
Not analysed yet 21 Sept 2026
CVE-2026-61749 CVE record

CVSS 6.5 Medium

InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure
- InvenTree
- Information disclosure
- Server-side request forgery (SSRF)
Not analysed yet 21 Sept 2026
CVE-2026-55473 CVE record

CVSS 6.0 Medium

HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress
- sysadminsmedia homebox
- Server-side request forgery (SSRF)
Not analysed yet 21 Sept 2026
CVE-2026-76898 CVE record

CVSS 7.7 High

draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js
- jgraph drawio
- Server-side request forgery (SSRF)
Not analysed yet 21 Sept 2026
CVE-2026-63334 CVE record

CVSS 6.8 Medium

draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist
- jgraph drawio
- Race condition
- Server-side request forgery (SSRF)
Not analysed yet 21 Sept 2026
CVE-2026-94401 CVE record

CVSS 8.3 High

MISP Arbitrary Local File Read and SSRF via MISP Export Upload
- MISP
- Path traversal
- Server-side request forgery (SSRF)
Not analysed yet 21 Sept 2026
CVE-2026-88403 CVE record

CVSS 6.5 Medium

A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request.
- Server-side request forgery (SSRF)
Not analysed yet 21 Sept 2026
CVE-2026-36469 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).
- Server-side request forgery (SSRF)
Not analysed yet 21 Sept 2026
CVE-2026-94051 CVE record

CVSS 5.3 Medium

0717376 cowork_bench pdf-tools-mcp server.py ControlFlowNode server-side request forgery
- 0717376 cowork_bench
- Server-side request forgery (SSRF)
Not analysed yet 20 Sept 2026
CVE-2026-94040 CVE record

CVSS 6.9 Medium

vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery
- vas3k TaxHacker
- Server-side request forgery (SSRF)
Not analysed yet 20 Sept 2026
CVE-2026-94039 CVE record

CVSS 6.9 Medium

vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery
- vas3k TaxHacker
- Server-side request forgery (SSRF)
Not analysed yet 20 Sept 2026
CVE-2026-94038 CVE record

CVSS 6.9 Medium

NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
- NonceGeek dim-sum-app
- Server-side request forgery (SSRF)
Not analysed yet 20 Sept 2026
CVE-2026-94028 CVE record

CVSS 5.3 Medium

mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery
- Mealie
- Server-side request forgery (SSRF)
Not analysed yet 20 Sept 2026
CVE-2026-16542 CVE record

CVSS 4.1 Medium

Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar
- Import and export users and customers
- Server-side request forgery (SSRF)
Not analysed yet 20 Sept 2026
CVE-2026-1641 CVE record

CVSS 6.5 Medium

Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting
- wowelements Wow Elements Addons for Elementor
- Server-side request forgery (SSRF)
Not analysed yet 19 Sept 2026
CVE-2026-75885 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
CVE-2026-76900 CVE record

CVSS 6.8 Medium

CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
- 1Panel-dev CordysCRM
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
CVE-2026-18869 CVE record

CVSS 6.4 Medium

IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]
- i
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
github.com/obot-platform/obot Go

CVSS 8.3 High

Obot: Server-Side Request Forgery via remote MCP server URL
- Server-side request forgery (SSRF)
- CWE-1188
<0.23.0 · fixed in 0.23.0

GHSA-jgh3-fggc-mcpm · CVE-2026-101064 Not analysed yet 18 Sept 2026
lmdeploy PyPI

CVSS 7.5 High

LMDeploy has an SSRF bypass
- Server-side request forgery (SSRF)
- CWE-436
>=0.12.3, <0.15.0 · fixed in 0.15.0

GHSA-39wr-7q6h-cf68 Not analysed yet 18 Sept 2026
CVE-2026-93506 CVE record

CVSS 5.3 Medium

SveltyCMS File Upload Endpoint upload-media server-side request forgery
- SveltyCMS
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
CVE-2026-93597 CVE record

CVSS 5.3 Medium

ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses
- ArcadeData arcadedb
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
CVE-2026-40537 CVE record

CVSS 4.3 Medium

Server-side request forgery in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
CVE-2026-67101 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

HCL BigFix Service Management is affected by multiple security vulnerabilities.
- HCL Software HCL BigFix Service Management
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
CVE-2026-12106 CVE record

CVSS 6.4 Medium

Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags
- airani Auto Upload Images
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
CVE-2026-90984 CVE record

CVSS 5.8 Medium

Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field
- Generate PDF using Contact Form 7
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
CVE-2026-77164 CVE record

CVSS 6.2 Medium

Server-side request forgery in Nextcloud Server
- Nextcloud Server
- Server-side request forgery (SSRF)
Not analysed yet 18 Sept 2026
CVE-2026-85917 CVE record

CVSS 7.5 High

Azure AI Foundry Elevation of Privilege Vulnerability
- Microsoft Azure AI Foundry
- Server-side request forgery (SSRF)
Not analysed yet 17 Sept 2026
CVE-2026-54734 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction
- prebid-server-java
- Server-side request forgery (SSRF)
Not analysed yet 17 Sept 2026
CVE-2026-54507 CVE record

CVSS 8.4 High

Vvveb oEmbedProxy vulnerable to server-side request forgery
- givanz Vvveb
- Server-side request forgery (SSRF)
Not analysed yet 17 Sept 2026
CVE-2026-93384 CVE record

CVSS 3.7 Low

Server-side request forgery in Google Chrome
- Google Chrome
- Server-side request forgery (SSRF)
Not analysed yet 17 Sept 2026
CVE-2026-54339 CVE record

CVSS 7.7 High

Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover
- LeslieLeung glean
- Server-side request forgery (SSRF)
Not analysed yet 17 Sept 2026
CVE-2026-54565 CVE record

CVSS 4.7 Medium

rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages
- edwardkim rhwp
- Information disclosure
- Server-side request forgery (SSRF)
Not analysed yet 17 Sept 2026
CVE-2026-54918 CVE record

CVSS 5.3 Medium

NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI
- netbox-community devicetype-library
- Server-side request forgery (SSRF)
- CWE-15
Not analysed yet 17 Sept 2026
oras.land/oras-go/v2 Go

CVSS 4.7 Medium

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
- Server-side request forgery (SSRF)
<2.6.2 · fixed in 2.6.2

GHSA-h7vf-4x9w-h99v · CVE-2026-85732 Not analysed yet 17 Sept 2026
io.kestra:core +1 Maven

CVSS 8.6 High

Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadata
- Server-side request forgery (SSRF)
<=1.3.31 · no fixed version yet

GHSA-r56g-q4p6-m3p6 · CVE-2026-73247 Not analysed yet 17 Sept 2026
CVE-2026-86862 CVE record

CVSS 7.1 High

pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools
- pgadmin.org pgAdmin 4
- Command injection
- Hard-coded credentials
Not analysed yet 17 Sept 2026
litellm PyPI

CVSS 5.3 Medium

LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
- Server-side request forgery (SSRF)
<1.83.9 · fixed in 1.83.9

GHSA-hx8v-g79f-8w5f · CVE-2026-59823 Not analysed yet 17 Sept 2026
nuxt-og-image npm

CVSS 6.9 Medium

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
- Server-side request forgery (SSRF)
- CWE-20
>=6.0.2, <6.7.0 · fixed in 6.7.0

GHSA-q8hw-4fvp-9rwv · CVE-2026-61793 Not analysed yet 17 Sept 2026
CVE-2026-81446 CVE record

CVSS 7.4 High

Server-side request forgery in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others
- Dell OpenManage Server Administrator Managed Node (Patch) for Windows
- Dell OpenManage Server Administrator Managed Node for RHEL 8.10
- Server-side request forgery (SSRF)
Not analysed yet 17 Sept 2026
CVE-2026-81443 CVE record

CVSS 6.4 Medium

Server-side request forgery in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others
- Dell OpenManage Server Administrator Managed Node (Patch) for Windows
- Dell OpenManage Server Administrator Managed Node for RHEL 8.10
- Server-side request forgery (SSRF)
Not analysed yet 17 Sept 2026
CVE-2026-66608 CVE record

CVSS 6.4 Medium

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Server-side request forgery (SSRF)
Not analysed yet 17 Sept 2026
CVE-2026-92932 CVE record

CVSS 5.1 Medium

MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled
- misp sachertortephp
- Server-side request forgery (SSRF)
- CWE-670
Not analysed yet 17 Sept 2026
CVE-2026-92576 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool
- HKUDS nanobot
- Server-side request forgery (SSRF)
Not analysed yet 16 Sept 2026
CVE-2026-92815 CVE record

CVSS 8.7 High

changedetection.io through 0.60.6 SSRF via browser-step Goto URL
- dgtlmoon changedetection.io
- Server-side request forgery (SSRF)
Not analysed yet 16 Sept 2026