Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.1 Medium
PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects
- PowerPress Podcasting plugin by Blubrry
- Server-side request forgery (SSRF)
- CVSS 5.7 Medium
Server-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import
- aws bedrock-agentcore-starter-toolkit
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Security Advisory 0186
- Arista Networks CloudVision Portal
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Security Advisory 0186
- Arista Networks CloudVision Portal
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS
- Gitea
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Gitea repository migration SSRF through DNS rebinding
- Gitea
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Gitea SSRF through Git HTTP redirects in mirrors and fetches
- Gitea
- Server-side request forgery (SSRF)
- CVSS 8.1 High
Gitea push mirror SSRF and forced writes to internal Git hosts
- Gitea
- Race condition
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Gitea migration and pull mirror SSRF through multi-answer DNS
- Gitea
- Information disclosure
- Race condition
- CVSS 8.7 High
Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts
- GitHub Enterprise Server
- Server-side request forgery (SSRF)
- CVSS 3.7 Low
i18next-http-backend incomplete URL validation permits SSRF
- Other injection
- Server-side request forgery (SSRF)
<4.0.2 · fixed in 4.0.2
GHSA-xvq9-wjp8-hwqf · CVE-2026-105800 - CVSS 6.4 Medium
Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects
- microsoft UFO
- Server-side request forgery (SSRF)
- CVSS 4.0, no score published
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
- Server-side request forgery (SSRF)
<1.10.3 · fixed in 1.10.3
GHSA-j8f7-x8jm-wmm4 - CVSS 6.9 Medium
Potential request forgery via spatial lookup byte values
- Django
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability
- instapagedev Instapage Plugin
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
- DeKnows PDF Smart Viewer for Elementor
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption
- Server-side request forgery (SSRF)
- CWE-20
>=3.9.0, <4.18.2 · fixed in 4.18.2
GHSA-qx36-8mw2-4r3x · CVE-2026-96747 - CVSS 8.3 High
Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint
- langgenius dify
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Improper validation of Ops Manager configuration in MongoDB Kubernetes Operator
- MongoDB, Inc. Mongodb Controllers for Kubernetes
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
O2OA General url ActionUploadExcelWithUrl server-side request forgery
- O2OA
- Server-side request forgery (SSRF)
- CVSS 6.0 Medium
Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download
- penpot
- Server-side request forgery (SSRF)
- CVSS 9.9 CriticalCritical · CVSS 9+
Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)
- plane
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint
- plane
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU
- plane
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Plane: SSRF in Gitea OAuth
- plane
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery
- plane
- Server-side request forgery (SSRF)
- CVSS 8.4 High
auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF
- cookpete auto-changelog
- Path traversal
- Command injection
- CVSS 8.4 High
Server-side request forgery in Eclipse Foundation Eclipse Che
- Eclipse Foundation Eclipse Che
- Path traversal
- Hard-coded credentials
- CVSS 6.3 Medium
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0
- svenbluege.de Event Gallery for Joomla
- Server-side request forgery (SSRF)
- CVSS 8.8 High
CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK
- Progress Software @progress/sitefinity-nextjs-sdk
- Server-side request forgery (SSRF)
- CVSS 6.7 Medium
LFI and GET SSRF via GStreamer and HLS playlists
- The Document Foundation LibreOffice
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 6.7 Medium
LFI and GET SSRF via calcext:data-mappings and csv provider
- The Document Foundation LibreOffice
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery
- feelec-yishu feelcrm-os
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery
- Shaarli
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
ChatGPTNextWeb NextChat Proxy Fallback proxy.ts proxyHandler server-side request forgery
- ChatGPTNextWeb NextChat
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint.
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification
- zitadel
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery
- SciPhi-AI R2R
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
- OpenIdentityPlatform OpenAM
- Server-side request forgery (SSRF)
- CVSS 8.4 High
SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)
- Server-side request forgery (SSRF)
<0.0.0-20260813142806-dd2778b70d02 · fixed in 0.0.0-20260813142806-dd2778b70d02
GHSA-x8gv-g2g3-65fj · CVE-2026-82234 - CVSS 7.1 High
SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass
- Cross-site request forgery (CSRF)
- Server-side request forgery (SSRF)
<0.0.0-20260803045322-cb67e0b4fab5 · fixed in 0.0.0-20260803045322-cb67e0b4fab5
GHSA-3cc2-h3v6-rqpq · CVE-2026-74802 - CVSS 8.7 High
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
- Command injection
- Code injection
>=0.1.0, <0.1.7 · fixed in 0.1.7
GHSA-jqmf-mx4f-hfr6 · CVE-2026-114107 - CVSS 5.3 Medium
Trigger.dev: Blind SSRF via alert-channel webhook
- Server-side request forgery (SSRF)
<4.5.2 · fixed in 4.5.2
GHSA-q567-cr4x-96w4 · CVE-2026-114076 - CVSS 6.3 Medium
UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf
- UTMStack
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
UTMStack < 11.2.16 SSRF via IdentityProviderService
- UTMStack
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
- Server-side request forgery (SSRF)
<4.5.2 · fixed in 4.5.2
GHSA-xxv7-2vv3-h682 · CVE-2026-85650 - CVSS 8.3 High
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS
- AWS loom
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS
- AWS loom
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile
- Weaver e-Bridge
- Server-side request forgery (SSRF)
- CVSS 4.0, no score published
rmcp OAuth client fetches server-controlled resource_metadata URLs
- Server-side request forgery (SSRF)
<2.0.0 · fixed in 2.0.0
GHSA-c9xm-49cp-xcr9 - CVSS 6.4 Medium
WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability
- ThemeREX Group ThemeREX Addons
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 8.8 High
YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 8.3 High
YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 8.3 High
YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 4.9 Medium
API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform
- HAVELSAN Inc. Sef - AI Chatbot Platform
- Server-side request forgery (SSRF)