Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.5 High
Arbitrary File Read and SSRF in Google AppSheet
- AppSheet Web (Main Server)
- Server-side request forgery (SSRF)
- CVSS 4.4 Medium
WordPress TS Poll plugin <= 2.5.5 - Server Side Request Forgery (SSRF) vulnerability
- totalsoft TS Poll
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
WordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerability
- KaizenCoders URL Shortify
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Extend Link plugin <= 2.0.0 - Server Side Request Forgery (SSRF) vulnerability
- Alobaidi Extend Link
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress Smart Auto Upload Images plugin <= 1.2.2 - Server Side Request Forgery (SSRF) vulnerability
- Burhan Nasir Smart Auto Upload Images
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
zhutoutoutousan worldquant-miner URL ssrf_proxy.py server-side request forgery
- zhutoutoutousan worldquant-miner
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Printful Integration for WooCommerce <= 2.2.11 - Authenticated (Contributor+) Server-Side Request Forgery
- Printful Integration for WooCommerce
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
SoftVision webPDF before 10.0.2 is vulnerable to Server-Side Request Forgery (SSRF).
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension
- Server-side request forgery (SSRF)
<2026.2.14 · fixed in 2026.2.14
GHSA-x22m-j5qq-j49m · CVE-2026-28451 - CVSS 5.3 Medium
Hugging Face Smolagents has a Server-Side Request Forgery issue
- Server-side request forgery (SSRF)
<=1.24.0 · no fixed version yet
GHSA-jxgv-6j54-wwc7 · CVE-2026-2654 - CVSS 4.3 Medium
Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Server-side request forgery (SSRF)
- CVSS 4.0, no score published
Withdrawn Advisory: Libredesk has a SSRF Vulnerability in Webhooks
- Information disclosure
- Server-side request forgery (SSRF)
<1.0.2-0.20260215211005-727213631ce6 · fixed in 1.0.2-0.20260215211005-727213631ce6
GHSA-wgm6-9rvv-3438 · CVE-2026-26957 - CVSS 6.3 Medium
OpenClaw affected by SSRF in optional Tlon (Urbit) extension authentication
- Server-side request forgery (SSRF)
<2026.2.14 · fixed in 2026.2.14
GHSA-pg2v-8xwh-qhcc · CVE-2026-28476 - CVSS 7.1 High
Server-side request forgery in NETAPP StorageGRID (formerly StorageGRID Webscale)
- NETAPP StorageGRID (formerly StorageGRID Webscale)
- Server-side request forgery (SSRF)
- CVSS 7.5 High
OpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)
- Server-side request forgery (SSRF)
<2026.2.14 · fixed in 2026.2.14
GHSA-jrvc-8ff5-2f9f · CVE-2026-26324 - CVSS 7.6 High
OpenClaw Gateway tool allowed unrestricted gatewayUrl override
- Server-side request forgery (SSRF)
<2026.2.14 · fixed in 2026.2.14
GHSA-g6q9-8fvw-f7rf · CVE-2026-26322 - CVSS 6.3 Medium
OpenClaw affected by SSRF via attachment/media URL hydration
- Server-side request forgery (SSRF)
<2026.2.2 · fixed in 2026.2.2
GHSA-wfp2-v9c7-fh79 · CVE-2026-28467 - CVSS 5.4 Medium
Multiple Vulnerabilities in IBM Concert Software.
- IBM Concert
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Indico has Server-Side Request Forgery (SSRF) in multiple places
- Race condition
- Server-side request forgery (SSRF)
<3.3.10 · fixed in 3.3.10
GHSA-f47c-3c5w-v7p4 · CVE-2026-25738 - CVSS 7.6 High
OpenClaw affected by SSRF in Image Tool Remote Fetch
- Server-side request forgery (SSRF)
<2026.2.2 · fixed in 2026.2.2
GHSA-56f2-hvwg-5743 - CVSS 7.9 High
Rocket TRUfusion Enterprise through 7.10.4.0 uses a reverse proxy to handle incoming connections.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
GeekAI net_handler.go Download server-side request forgery
- GeekAI
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
cskefu Endpoint MediaController.java server-side request forgery
- cskefu
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. S...
- Server-side request forgery (SSRF)
<26.0.0rc1 · fixed in 26.0.0rc1
GHSA-6xw9-2p64-7622 · CVE-2026-2531 - CVSS 5.3 Medium
lintsinghua DeepAudit IP Address embedding_config.py server-side request forgery
- lintsinghua DeepAudit
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery
- MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
User Language Switch <= 1.6.10 - Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter
- webilop User Language Switch
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Tandoor Recipes affected by Blind SSRF with Internal Network Access via Recipe Import
- recipes
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
ClipBucket v5 enables internal network scans via an SSRF vulnerability
- MacWarrior clipbucket-v5
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src
- mateuszgbiorczyk Converter for Media – Optimize images | Convert WebP & AVIF
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation
- Server-side request forgery (SSRF)
<1.1.14 · fixed in 1.1.14
GHSA-gf3v-fwqg-4vh7 · CVE-2026-26019 - CVSS 3.7 Low
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
- Server-side request forgery (SSRF)
<1.2.11 · fixed in 1.2.11
GHSA-2g6r-c272-w58r · CVE-2026-26013 - CVSS 4.3 Medium
Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Server-Side Request Forgery (SSRF) in GitLab
- GitLab
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
DoraCMS <= 3.1 UEditor Remote Image Fetch SSRF
- doramart DoraCMS
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Azure DevOps Server Cross-Site Scripting Vulnerability
- Microsoft Azure DevOps Server 2022
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
SSRF in Teknolist Computer's Okulistik
- Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url
- Server-side request forgery (SSRF)
>=1.0.0, <1.10.5 || >=2.0.0, <2.14.1 · fixed in 1.10.5, 2.14.1
GHSA-33mh-2634-fwr2 · CVE-2026-25765 - CVSS 5.8 Medium
LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection
- Server-side request forgery (SSRF)
>=0.3.41, <0.4.6 · fixed in 0.4.6
GHSA-v34v-rq6j-cj6p · CVE-2026-25528 - CVSS 6.9 Medium
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via Alternative IP Notation
- Server-side request forgery (SSRF)
>=4.0.0-RC1, <4.16.18 || >=5.0.0-RC1, <5.8.22 · fixed in 4.16.18, 5.8.22
GHSA-m5r2-8p9x-hp5m · CVE-2026-25494 - CVSS 6.9 Medium
Craft CMS Vulnerable to SSRF in GraphQL Asset Mutation via HTTP Redirect
- Server-side request forgery (SSRF)
>=4.0.0-RC1, <4.16.18 || >=5.0.0-RC1, <5.8.22 · fixed in 4.16.18, 5.8.22
GHSA-8jr8-7hr4-vhfx · CVE-2026-25493 - CVSS 5.3 Medium
Craft CMS: save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying host
- Server-side request forgery (SSRF)
>=3.5.0, <4.16.18 || >=5.0.0-RC1, <5.8.22 · fixed in 4.16.18, 5.8.22
GHSA-96pq-hxpw-rgh8 · CVE-2026-25492 - CVSS 5.4 Medium
Fluent Forms Pro Add On Pack <= 6.1.12 - Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource'
- techjewel Fluent Forms Pro Add On Pack
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access
- Server-side request forgery (SSRF)
<=0.0.22 · no fixed version yet
GHSA-6fgp-m6q4-j3q5 · CVE-2026-25904 - CVSS 5.3 Medium
Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping
- homarr
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling
- Server-side request forgery (SSRF)
>=0.0.26, <1.56.0 · fixed in 1.56.0
GHSA-2jrp-274c-jhv3 · CVE-2026-25580 - CVSS 3.7 Low
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
- Server-side request forgery (SSRF)
>=5.49.0, <5.104.1 · fixed in 5.104.1
GHSA-8fgc-7cc6-rx7x · CVE-2025-68458 - CVSS 3.7 Low
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
- Server-side request forgery (SSRF)
>=5.49.0, <5.104.0 · fixed in 5.104.0
GHSA-38r7-794h-5758 · CVE-2025-68157 - CVSS 7.2 High
All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint
- bplugins All In One Image Viewer Block – Gutenberg block to create image viewer with hyperlink
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
AutoGPT has SSRF vulnerability in SendDiscordFileBlock
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
AutoGPT has SSRF vulnerability in ReadRSSFeedBlock
- Significant-Gravitas AutoGPT
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
ZenTao Webhook model.php fetchHook server-side request forgery
- ZenTao
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Group-Office is vulnerable to SSRF and File Read in WOPI service discovery
- Intermesh groupoffice
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
GLPI is Vulnerable to SSRF via Webhooks
- glpi
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Mailpit has a Server-Side Request Forgery (SSRF) via HTML Check API in github.com/axllent/mailpit
- Server-side request forgery (SSRF)
<1.28.3 · fixed in 1.28.3
GHSA-6jxm-fv7w-rw5j · CVE-2026-23845 - CVSS 5.4 Medium
WordPress Grand Blog theme < 3.1.5 - Server Side Request Forgery (SSRF) vulnerability
- ThemeGoods Grand Blog
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature.
- Server-side request forgery (SSRF)
- CVSS 8.1 High
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper
- Server-side request forgery (SSRF)
- CWE-441
<0.24.0 · fixed in 0.24.0
GHSA-mxxc-p822-2hx9 · CVE-2026-24470 - CVSS 7.1 High
XML eXternal Entity injection (XXE) vulnerability affect IBM Business Automation Workflow -
- IBM Business Automation Workflow containers
- IBM Business Automation Workflow traditional
- Server-side request forgery (SSRF)
- CVSS 2.7 Low
Keycloak Server-Side Request Forgery (SSRF) vulnerability
- Server-side request forgery (SSRF)
<=26.5.2 · no fixed version yet
GHSA-fwhw-chw4-gh37 · CVE-2026-1518