Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.1 High
TrustTunnel has SSRF and private network restriction bypass via numeric address destinations
- TrustTunnel
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL Functionality
- Server-side request forgery (SSRF)
<0.301.0 · fixed in 0.301.0
GHSA-xr7v-j379-34v9 · CVE-2026-24767 - CVSS 7.6 High
FinalDestination hostname matching allows SSRF protection bypass
- discourse
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
ILIAS Learning Management System 4.3 - SSRF
- ilias.de ILIAS Learning Management System
- Server-side request forgery (SSRF)
- CVSS 7.1 High
vLLM vulnerable to Server-Side Request Forgery (SSRF) through MediaConnector
- Server-side request forgery (SSRF)
<0.14.1 · fixed in 0.14.1
GHSA-qh4c-xf7m-gxfc · CVE-2026-24779 - CVSS 6.5 Medium
TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
- CWE-693
<=0.1.0 · no fixed version yet
GHSA-gpx9-96j6-pp87 - CVSS 7.2 High
TableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter
- bloompixel TableMaster for Elementor – Advanced Responsive Tables for Elementor
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration
- squidex
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Kyverno Cross-Namespace Privilege Escalation via Policy apiCall
- Privilege escalation
- Server-side request forgery (SSRF)
<1.15.3 || >=1.16.0-rc.1, <1.16.3 · fixed in 1.15.3, 1.16.3
GHSA-8p9x-46gm-qfx2 · CVE-2026-22039 - CVSS 5.1 Medium
Blind Server-Side Request Forgery (SSRF) in Omada Controller
- TP-Link Systems Inc. Omada Controller
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
- wpmessiah Frontis Blocks — Block Library for the Block Editor
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress Radio Player plugin <= 2.0.91 - Server Side Request Forgery (SSRF) vulnerability
- princeahmed Radio Player
- Server-side request forgery (SSRF)
- CVSS 7.5 High
FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`
- fogproject
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL
- Server-side request forgery (SSRF)
<1.5.0 · fixed in 1.5.0
GHSA-4c4x-jm2x-pf9j · CVE-2026-24117 - CVSS 5.4 Medium
WordPress PhotoMe theme < 5.7.2 - Server Side Request Forgery (SSRF) vulnerability
- ThemeGoods PhotoMe
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Server Side Request Forgery (SSRF) vulnerability
- Craig Hewitt Seriously Simple Podcasting
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress IMGspider plugin <= 2.3.12 - Server Side Request Forgery (SSRF) vulnerability
- wbolt.com IMGspider
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress Electrician - Electrical Service WordPress theme <= 5.6 - Server Side Request Forgery (SSRF) vulnerability
- SmartDataSoft Electrician - Electrical Service WordPress
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress Frontis Blocks plugin <= 1.1.5 - Server Side Request Forgery (SSRF) vulnerability
- WP Messiah Frontis Blocks
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerability
- Marco van Wieren WPO365
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress ANAC XML Viewer plugin <= 1.8.2 - Server Side Request Forgery (SSRF) vulnerability
- Marco Milesi ANAC XML Viewer
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
WordPress Pool Services theme <= 3.3 - Server Side Request Forgery (SSRF) vulnerability
- SmartDataSoft Pool Services
- Server-side request forgery (SSRF)
- CVSS 7.5 High
A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK thru 11.6.0.
- Server-side request forgery (SSRF)
- CVSS 3.5 Low
Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`
- Server-side request forgery (SSRF)
<0.12.2 || >=0.13.0, <0.13.2 || >=0.14.0, <0.14.1 · fixed in 0.12.2, 0.13.2, 0.14.1
GHSA-q2x5-4xjx-c6p9 · CVE-2026-24048 - CVSS 7.5 High
WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
- Open redirect
- Server-side request forgery (SSRF)
<68.0 · fixed in 68.0
GHSA-983w-rhvv-gwmv · CVE-2025-68616 - CVSS 5.8 Medium
Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)
- Server-side request forgery (SSRF)
<=25.0.3 · no fixed version yet
GHSA-7vw6-5q2f-7w5r · CVE-2026-1180 - CVSS 8.3 High
Chainlit contain a server-side request forgery (SSRF) vulnerability
- Server-side request forgery (SSRF)
<2.9.4 · fixed in 2.9.4
GHSA-2g59-m95p-pgfq · CVE-2026-22219 - CVSS 5.3 Medium
xiweicheng TMS HtmlUtil.java summary server-side request forgery
- xiweicheng TMS
- Server-side request forgery (SSRF)
- CVSS 2.2 Low
Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
- andy_moyle Church Admin
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Arbitrary File Read in Google BigQuery Sink connector
- Aiven-Open bigquery-connector-for-apache-kafka
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability
- Server-side request forgery (SSRF)
<=26.1.11 · no fixed version yet
GHSA-fccg-7w3p-w66f · CVE-2025-15104 - CVSS 5.0 Medium
DK PDF – WordPress PDF Generator <= 2.3.0 - Authenticated (Author+) Server-Side Request Forgery
- torstenbulk DK PDF – WordPress PDF Generator
- Server-side request forgery (SSRF)
- CVSS 6.1 Medium
Server-side request forgery in NAVER lucy-xss-filter
- NAVER lucy-xss-filter
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Umbraco CMS contains a server-side request forgery vulnerability
- Server-side request forgery (SSRF)
=8.14.1 · no fixed version yet
GHSA-h66j-xm43-47pp · CVE-2021-47776 - CVSS 8.4 High
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
- Denial of service
- Server-side request forgery (SSRF)
>=5.4.1, <5.5.1 · fixed in 5.5.1
GHSA-j62c-4x62-9r35 · CVE-2025-67647 - CVSS 6.2 Medium
Nexus Repository 3 - Server-Side Request Forgery in Proxy Repository Configuration
- Sonatype Nexus Repository
- Server-side request forgery (SSRF)
- CVSS 8.6 High
External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector
- Elastic Kibana
- Server-side request forgery (SSRF)
- CVSS 7.2 High
GetContentFromURL <= 1.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute
- daschmi GetContentFromURL
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
- Server-side request forgery (SSRF)
<1.8.5 · fixed in 1.8.5
GHSA-59jp-pj84-45mr · CVE-2026-22772 - CVSS 5.4 Medium
Microsoft SharePoint Information Disclosure Vulnerability
- Microsoft SharePoint Enterprise Server 2016
- Microsoft SharePoint Server 2019
- Server-side request forgery (SSRF)
- CVSS 3.4 Low
Server-side request forgery in Fortinet FortiSandbox
- Fortinet FortiSandbox
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-level privileges to access other users' information via a crafted API request.
- Server-side request forgery (SSRF)
- CVSS 2.1 Low
Metabase channel test endpoint can reach internal local addresses
- metabase
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources in miniflux.app
- Server-side request forgery (SSRF)
* · no fixed version yet
GHSA-xwh2-742g-w3wp · CVE-2026-21885 - CVSS 5.8 Medium
Mailpit Proxy Endpoint has Server-Side Request Forgery (SSRF) vulnerability in github.com/axllent/mailpit
- Server-side request forgery (SSRF)
<1.28.1 · fixed in 1.28.1
GHSA-8v65-47jx-7mfr · CVE-2026-21859 - CVSS 4.3 Medium
Featured Image from URL (FIFU) <= 5.3.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'fifu_input_url'
- marceljm Featured Image from URL (FIFU)
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Ghost has SSRF via External Media Inliner
- Server-side request forgery (SSRF)
>=5.105.0, <5.130.6 || >=6.0.0, <6.11.0 · fixed in 5.130.6, 6.11.0
GHSA-vmc4-9828-r48r · CVE-2026-22597 - CVSS 8.7 High
picklescan has Arbitrary file read using `io.FileIO`
- Path traversal
- Server-side request forgery (SSRF)
<0.0.35 · fixed in 0.0.35
GHSA-9726-w42j-3qjr · CVE-2026-53872 - CVSS 7.1 High
Mastodon has SSRF Protection bypass
- mastodon
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress nK Themes Helper plugin <= 1.7.9 - Server Side Request Forgery (SSRF) vulnerability
- _nK nK Themes Helper
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
INIM Electronics Smartliving SmartLAN/G/SI <=6.x Unauthenticated SSRF via GetImage
- INIM Electronics s.r.l. Smartliving SmartLAN/G/SI
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions
- danny-avila LibreChat
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Knowage is vulnerable to blind server-side request forgery (SSRF)
- KnowageLabs Knowage-Server
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress External Media plugin <= 1.0.36 - Server Side Request Forgery (SSRF) vulnerability
- minnur External Media
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
invoiceninja Migration Import Import.php copy server-side request forgery
- invoiceninja
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Xagio SEO <= 7.1.0.30 - Authenticated (Subscriber+) Server-Side Request Forgery
- Xagio SEO – AI Powered SEO
- Server-side request forgery (SSRF)
- CVSS 7.9 High
Spinnaker vulnerable to SSRF due to improper restrictions on http from user input
- Server-side request forgery (SSRF)
- CWE-20
<2025.1.6 || >=2025.2.0, <2025.2.3 · fixed in 2025.1.6, 2025.2.3
GHSA-vrjc-q2fh-6x9h · CVE-2025-61916 - CVSS 6.5 Medium
evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API
- Server-side request forgery (SSRF)
<=2.1.0 · no fixed version yet
GHSA-vp8w-wj4m-3r7j · CVE-2025-67427 - CVSS 5.0 Medium
Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload Mutation
- Server-side request forgery (SSRF)
>=3.5.0, <4.16.17 || >=5.0.0-RC1, <5.8.21 · fixed in 4.16.17, 5.8.21
GHSA-x27p-wfqw-hfcc · CVE-2025-68437