Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.8 Medium
Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak
- Red Hat build of Keycloak 26.4
- Red Hat build of Keycloak 26.4.12
- Server-side request forgery (SSRF)
- CVSS 8.6 High
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
- Server-side request forgery (SSRF)
<=25.0 · no fixed version yet
GHSA-9x67-f2v7-63rw · CVE-2026-33039 - CVSS 5.3 Medium
frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery
- frdel agent-zero
- agent0ai agent-zero
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
taoofagi easegen-admin PPT File PPTUtil.java downloadFile server-side request forgery
- taoofagi easegen-admin
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
- Server-side request forgery (SSRF)
>=5.0.0, <5.0.7 · fixed in 5.0.7
GHSA-6j68-gcc3-mq73 · CVE-2026-32812 - CVSS 5.1 Medium
Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration
- Server-side request forgery (SSRF)
>=1.4.0, <1.6.4 || >=1.7.0-rc.1, <1.7.9 || >=1.8.0-rc.1, <1.8.12 || >=1.9.0-rc.1, <1.9.5 · fixed in 1.6.4, 1.7.9, 1.8.12, 1.9.5
GHSA-j94x-8wcp-x7hm · CVE-2026-32828 - CVSS 4.3 Medium
Mattermost fails to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation
- Server-side request forgery (SSRF)
<5.3.2-0.20260129133647-5d787969c2d5 || >=10.11.0-rc1, <10.11.11 || >=11.2.0-rc1, <11.2.3 || >=11.3.0-rc1, <11.3.1 · fixed in 5.3.2-0.20260129133647-5d787969c2d5, 10.11.11, 11.2.3, 11.3.1
GHSA-gqv7-j2j8-qmwq · CVE-2026-2455 - CVSS 9.1 CriticalCritical · CVSS 9+
Spinnaker clouddriver and orca URL validation bypass via underscores in hostnames
- Server-side request forgery (SSRF)
>=2025.1.6, <2025.2.4 || >=2025.3.0, <2025.3.1 || >=2025.4.0, <2025.4.1 · fixed in 2025.2.4, 2025.3.1, 2025.4.1
GHSA-8r8j-gfhg-fw38 · CVE-2026-25534 - CVSS 5.1 Medium
Server-Site Request Forgery in Raytha CMS
- Raytha
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
vanna-ai vanna Endpoint __init__.py run_sql server-side request forgery
- vanna
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
FlowCI flow-core-x SMTP Host ConfigServiceImpl.java save server-side request forgery
- FlowCI flow-core-x
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
glowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl server-side request forgery
- glowxq-oj
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Centrifugo: SSRF via unverified JWT claims interpolated into dynamic JWKS endpoint URL
- Server-side request forgery (SSRF)
<=2.4.0 · no fixed version yet
GHSA-j77h-rr39-c552 · CVE-2026-32301 - CVSS 5.4 Medium
WordPress Gift Up Gift Cards for WordPress and WooCommerce plugin <= 3.1.7 - Server Side Request Forgery (SSRF) vulnerability
- Gift Up! Gift Up Gift Cards for WordPress and WooCommerce
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability
- Katsushi Kawamori Simple Blog Card
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
WordPress MailerPress plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability
- MailerPress
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
WordPress Embed PDF Viewer plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability
- Andy Fragen Embed PDF Viewer
- Server-side request forgery (SSRF)
- CVSS 1.7 Low
@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch
- Server-side request forgery (SSRF)
<0.27.1 · fixed in 0.27.1
GHSA-qp4c-xg64-7c6x · CVE-2026-32236 - CVSS 5.3 Medium
ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
- Server-side request forgery (SSRF)
<7.0.0 · fixed in 7.0.0
GHSA-fmfg-9g7c-3vq7 · CVE-2026-32111 - CVSS 8.3 High
SiYuan has a Full-Read SSRF via /api/network/forwardProxy
- Server-side request forgery (SSRF)
<3.6.0 · fixed in 3.6.0
GHSA-56cv-c5p2-j2wg · CVE-2026-32110 - CVSS 5.3 Medium
648540858 wvp-GB28181-pro IP Address ABLMediaNodeServerService.java getDownloadFilePath server-side request forgery
- 648540858 wvp-GB28181-pro
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
zyddnys manga-image-translator Translate Endpoints request_extraction.py to_pil_image server-side request forgery
- zyddnys manga-image-translator
- Server-side request forgery (SSRF)
- CVSS 7.8 High
2FAuth has Blind SSRF in image parameter allows internal network access and more
- Bubka 2FAuth
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Woahai321 ListSync JSON api_server.py requests.post server-side request forgery
- Woahai321 ListSync
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Plunk has SSRF via unvalidated AWS SNS SubscriptionConfirmation in POST /webhooks/sns
- plunk
- Server-side request forgery (SSRF)
- CVSS 3.0 Low
Blind SSRF on OpenProject instance via webhooks
- opf openproject
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Frappe: Possible SSRF by any authenticated user
- frappe
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Commerce
- Adobe Commerce B2B
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe Commerce
- Adobe Commerce B2B
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval
- Server-side request forgery (SSRF)
- CWE-20
<0.7.1 · fixed in 0.7.1
GHSA-7q3q-5px6-4c5p · CVE-2026-31959 - CVSS 7.1 High
Flowise affected by Server-Side Request Forgery (SSRF) in HTTP Node Leading to Internal Network Access
- Server-side request forgery (SSRF)
<3.0.13 · fixed in 3.0.13
GHSA-fvcw-9w9r-pxc7 · CVE-2026-31829 - CVSS 7.5 High
An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.
- Server-side request forgery (SSRF)
- CVSS 7.5 High
pdfmake is vulnerable to server-side request forgery (SSRF)
- Server-side request forgery (SSRF)
>=0.3.0-beta.2, <0.3.6 · fixed in 0.3.6
GHSA-wp52-r2fp-4vmr · CVE-2026-26801 - CVSS 7.7 High
LinkAce affected by SSRF via link creation: NoPrivateIpRule not applied to LinkStoreRequest
- Kovah LinkAce
- Server-side request forgery (SSRF)
- CVSS 8.2 HighCritical · CVSS 7+ and EPSS
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
- Server-side request forgery (SSRF)
<0.17.0 · fixed in 0.17.0
GHSA-7r34-79r5-rcc9 · CVE-2026-27826 - CVSS 8.8 High
Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network
- Server-side request forgery (SSRF)
>=1.0.0, <1.0.2 || >=2.0.0-beta.1, <2.0.0-beta.17 · fixed in 1.0.2, 2.0.0-beta.17
GHSA-hhfx-wfvq-7g9c · CVE-2026-26118 - CVSS 2.1 Low
ZITADEL has potential SSRF via Actions in github.com/zitadel/zitadel
- Server-side request forgery (SSRF)
<1.80.0-v2.20.0.20260225053328-b2532e966621 · fixed in 1.80.0-v2.20.0.20260225053328-b2532e966621
GHSA-7777-fhq9-592v · CVE-2026-27945 - CVSS 7.5 High
Azure IOT Explorer Spoofing Vulnerability
- Microsoft Azure IoT Explorer
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 6.4 Medium
Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP
- SAP_SE SAP NetWeaver Application Server for ABAP
- Server-side request forgery (SSRF)
- CVSS 7.1 High
vLLM has SSRF Protection Bypass
- Server-side request forgery (SSRF)
- CWE-474
>=0.15.1, <0.17.0 · fixed in 0.17.0
GHSA-v359-jj2v-j536 · CVE-2026-25960 - CVSS 7.5 High
Server-Side Request Forgery (SSRF) in ikea dirigera
- ikea dirigera
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master.
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Bytedesk SpringAIGiteeRestController SpringAIGiteeRestService.java getModels server-side request forgery
- Bytedesk
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Bytedesk SpringAIOpenrouterRestController SpringAIOpenrouterRestService.java getModels server-side request forgery
- Bytedesk
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
ContiNew Admin Storage Management S3ClientFactory.java URI.create server-side request forgery
- ContiNew Admin
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
xuxueli xxl-job JobInfoController.java server-side request forgery
- xuxueli xxl-job
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
bufanyun HotGo Endpoint upload.go ImageTransferStorage server-side request forgery
- bufanyun HotGo
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
welovemedia FFmate webhook.go fireWebhook server-side request forgery
- welovemedia FFmate
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Homarr: Unauthenticated SSRF in rssFeed.ts
- homarr
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Wallos: Server-Side Request Forgery (SSRF) in Notification Testers
- ellite Wallos
- Weak cryptography or TLS
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Wallos: SSRF via webhook test endpoint
- ellite Wallos
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Wallos: SSRF via url parameter leading to File Traversal
- ellite Wallos
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
WeKnora has DNS Rebinding Vulnerability in web_fetch Tool that Allows SSRF to Internal Resources
- Server-side request forgery (SSRF)
<0.3.0 · fixed in 0.3.0
GHSA-h6gw-8f77-mmmp · CVE-2026-30858 - CVSS 9.1 CriticalCritical · CVSS 9+
soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import
- Server-side request forgery (SSRF)
>=0.6.0, <0.11.4 · fixed in 0.11.4
GHSA-3fvx-xrxq-8jvv · CVE-2026-30832 - CVSS 9.3 CriticalCritical · CVSS 9+
Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading
- Wekan
- Server-side request forgery (SSRF)
- CVSS 7.5 High
PinchTab has SSRF with Full Response Exfiltration via Download Handler
- Server-side request forgery (SSRF)
<0.7.7 · fixed in 0.7.7
GHSA-rw8p-c6hf-q3pg · CVE-2026-30834 - CVSS 9.3 CriticalCritical · CVSS 9+
Ghostfolio: Full-Read SSRF in Manual Asset Import
- ghostfolio
- Server-side request forgery (SSRF)
- CVSS 8.2 High
OpenSift: Insufficient URL destination restrictions in ingest flow could enable SSRF-style internal access
- OpenSift
- Server-side request forgery (SSRF)
- CVSS 5.9 Medium
WeKnora is Vulnerable to SSRF via Redirection
- Server-side request forgery (SSRF)
<0.2.12 · fixed in 0.2.12
GHSA-595m-wc8g-6qgc · CVE-2026-30247 - CVSS 8.5 High
Plane has SSRF via Incomplete IP Validation in Webhook URL Serializer
- Server-side request forgery (SSRF)
<1.2.3 · fixed in 1.2.3
GHSA-fpx8-73gf-7x73 · CVE-2026-30242