Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
Page-Replica Page Replica Endpoint sitemap sitemap.fetch server-side request forgery
- Page-Replica Page Replica
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before.
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs
- Lychee
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025
- Drupal OpenID Connect / OAuth client
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked
- Lychee
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints
- Server-side request forgery (SSRF)
<=26.0 · no fixed version yet
GHSA-f359-r3pv-2phf · CVE-2026-33766 - CVSS 7.8 High
Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation
- Firecrawl
- Server-side request forgery (SSRF)
- CVSS 3.1 Low
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation
- Server-side request forgery (SSRF)
>=26.5.0, <26.6.3 || <26.4.13 · fixed in 26.6.3, 26.4.13
GHSA-22rm-wp4x-v5cx · CVE-2026-4874 - CVSS 6.6 Medium
Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL
- Hard-coded credentials
- Server-side request forgery (SSRF)
<4.0.0 · fixed in 4.0.0
GHSA-c83f-3xp6-hfcp · CVE-2026-33182 - CVSS 4.7 Medium
Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)
- Server-side request forgery (SSRF)
<1.54.0 · fixed in 1.54.0
GHSA-7p48-42j8-8846 · CVE-2026-33682 - CVSS 6.4 Medium
Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download
- Server-side request forgery (SSRF)
<2.2.1 · fixed in 2.2.1
GHSA-g9xj-752q-xh63 · CVE-2026-33679 - CVSS 6.4 Medium
Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources
- Server-side request forgery (SSRF)
<2.2.1 · fixed in 2.2.1
GHSA-g66v-54v9-52pr · CVE-2026-33675 - CVSS 5.4 Medium
IBM InfoSphere Information Server is vulnerable to server-side request forgery
- IBM InfoSphere Information Server
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
- Server-side request forgery (SSRF)
<0.7.0-beta.9 · fixed in 0.7.0-beta.9
GHSA-q537-8fr5-cw35 · CVE-2026-33693 - CVSS 5.4 Medium
IBM InfoSphere Information Server is vulnerable to server-side request forgery
- IBM InfoSphere Information Server
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
IBM WebSphere Application Server Liberty Server-Side Request Forgery
- IBM WebSphere Application Server Liberty
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
AVideo: Full-Read SSRF Through Unvalidated statsURL Parameter in plugin/Live/test.php
- Server-side request forgery (SSRF)
<=26.0 · no fixed version yet
GHSA-wxjx-r2j2-96fx - CVSS 6.4 Medium
WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability
- Wasiliy Strecker / ContestGallery developer Contest Gallery
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017
- Drupal Canvas
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl
- Server-side request forgery (SSRF)
<0.8.4 · fixed in 0.8.4
GHSA-xqq2-4j46-vwp7 · CVE-2026-33619 - CVSS 7.1 High
Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php
- ellite Wallos
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840
- ellite Wallos
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Wallos: SSRF via HTTP Proxy Environment Variable
- ellite Wallos
- Server-side request forgery (SSRF)
- Information disclosure
- CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint
- ParisNeo lollms-webui
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery
- DefaultFuction Jeson-Customer-Relationship-Management-System
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
- Server-side request forgery (SSRF)
<2.3.42 || >=2.4.0, <2.5.44 || >=2.6.0, <2.6.28 || >=2.7.0, <2.7.9 · fixed in 2.3.42, 2.5.44, 2.6.28, 2.7.9
GHSA-rc55-58f4-687g · CVE-2026-33486 - CVSS 6.8 Medium
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin
- Server-side request forgery (SSRF)
<1.41.1 || >=2.0.0, <2.41.1 · fixed in 1.41.1, 2.41.1
GHSA-jh46-85jr-6ph9 · CVE-2026-32279 - CVSS 5.3 Medium
kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery
- kalcaddle kodbox
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
trueleaf ApiFlow URL Validation http_proxy.service.ts validateUrlSecurity server-side request forgery
- trueleaf ApiFlow
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Content Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
- benmoody Content Syndication Toolkit
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Performance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
- qrolic Performance Monitor
- Server-side request forgery (SSRF)
- CVSS 8.3 High
MimeTypes Link Icons <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content
- eagerterrier MimeTypes Link Icons
- Server-side request forgery (SSRF)
- CVSS 3.8 Low
Post Affiliate Pro <= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field
- jurajsim Post Affiliate Pro
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WowOptin: Next-Gen Popup Maker <= 1.4.29 - Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API
- wpxpo WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo has Unauthenticated SSRF via plugin/Live/test.php
- Server-side request forgery (SSRF)
<=26.0 · no fixed version yet
GHSA-3fpm-8rjr-v5mc · CVE-2026-33502 - CVSS 8.9 High
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
- Server-side request forgery (SSRF)
<5.5.10 · fixed in 5.5.10
GHSA-pgx6-7jcq-2qff · CVE-2026-82866 - CVSS 8.6 High
AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy
- Server-side request forgery (SSRF)
<=26.0 · no fixed version yet
GHSA-p3gr-g84w-g8hh · CVE-2026-33480 - CVSS 5.0 Medium
Frigate has SSRF vulnerability in /ffprobe endpoint
- blakeblackshear frigate
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo-Encoder has Unauthenticated Blind Server-Side Request Forgery via Public Thumbnail Generator
- WWBN AVideo-Encoder
- Server-side request forgery (SSRF)
- CVSS 8.7 High
SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL
- dataease SQLBot
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
SuiteCRM vulnerable to authenticated SSRF via PDF export
- SuiteCRM
- Server-side request forgery (SSRF)
- CVSS 7.1 High
SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet
- SuiteCRM
- Server-side request forgery (SSRF)
- CVSS 9.9 CriticalCritical · CVSS 9+
Microsoft Exchange Elevation of Privilege Vulnerability
- Microsoft Exchange Online
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Microsoft Bing Tampering Vulnerability
- Microsoft Bing
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Microsoft Purview Elevation of Privilege Vulnerability
- Microsoft Purview
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Microsoft Purview Elevation of Privilege Vulnerability
- Microsoft Purview
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Azure Cloud Shell Elevation of Privilege Vulnerability
- Microsoft Azure Cloud Shell
- Server-side request forgery (SSRF)
- CVSS 7.2 High
OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)
- openemr
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass
- Server-side request forgery (SSRF)
<=26.0 · no fixed version yet
GHSA-5f7v-4f6g-74rj · CVE-2026-33351 - CVSS 6.3 Medium
league/commonmark has an embed extension allowed_domains bypass
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
>=2.3.0, <2.8.2 · fixed in 2.8.2
GHSA-hh8v-hgvp-g3f5 · CVE-2026-33347 - CVSS 5.0 Medium
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources
- Server-side request forgery (SSRF)
<=25.0 · no fixed version yet
GHSA-66cw-h2mj-j39p · CVE-2026-33294 - CVSS 5.3 Medium
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS
- BMC Software, Inc. FootPrints
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb
- BMC Software, Inc. FootPrints
- Server-side request forgery (SSRF)
- CVSS 5.5 Medium
AVideo has SSRF in Scheduler Plugin via callbackURL Missing `isSSRFSafeURL()` Validation
- Server-side request forgery (SSRF)
<26.0 · fixed in 26.0
GHSA-v467-g7g7-hhfh · CVE-2026-33237 - CVSS 7.4 High
Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy
- Server-side request forgery (SSRF)
* · no fixed version yet
GHSA-44c9-4rg5-qjgq - CVSS 7.5 High
The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability.
- Server-side request forgery (SSRF)
- CVSS 8.6 HighCritical · CVSS 7+ and EPSS
Kan is Vulnerable to Unauthenticated SSRF via Attachment Download Endpoint
- kan
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
- Server-side request forgery (SSRF)
<=3.30.6 · no fixed version yet
GHSA-4647-wpjq-hh7f · CVE-2026-33226 - CVSS 5.8 Medium
PinchTab has a Blind SSRF via browser-side redirect bypass in /download URL validation
- Server-side request forgery (SSRF)
<0.8.3 · fixed in 0.8.3
GHSA-qwxp-6qf9-wr4m · CVE-2026-33081 - CVSS 5.3 Medium
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networks
- Server-side request forgery (SSRF)
<0.4.85 · fixed in 0.4.85
GHSA-3xm7-qw7j-qc8v · CVE-2026-33060