Advisories · Weakness

Server-side request forgery (SSRF).

The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-104120 CVE record

CVSS 6.9 Medium

modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery
- modelcontextprotocol mcp-server-fetch
- modelcontextprotocol mcp-server-everything
- Server-side request forgery (SSRF)
Not analysed yet 2 Oct 2026
CVE-2026-100251 CVE record

CVSS 6.9 Medium

Wormhole.app SSRF
- Wormhole
- Server-side request forgery (SSRF)
Not analysed yet 1 Oct 2026
CVE-2026-56661 CVE record

CVSS 7.5 High

GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint
- GetSimpleCMS-CE
- Server-side request forgery (SSRF)
Not analysed yet 1 Oct 2026
CVE-2026-56660 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
- GetSimpleCMS-CE
- Cross-site request forgery (CSRF)
- Unrestricted file upload
Not analysed yet 1 Oct 2026
CVE-2026-55232 CVE record

CVSS 7.6 High

Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy
- givanz Vvveb
- Server-side request forgery (SSRF)
Not analysed yet 1 Oct 2026
swift PyPI

CVSS 5.3 Medium

OpenStack Swift vulnerable to authenticated server-side request forgery
- Server-side request forgery (SSRF)
<2.37.2 · fixed in 2.37.2

GHSA-h8rc-w822-q8vq · CVE-2026-50221 Not analysed yet 1 Oct 2026
jupyterlab PyPI

CVSS 5.4 Medium

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
- Command injection
- Information disclosure
>=4.0.0, <4.5.11 || >=4.6.0, <4.6.4 · fixed in 4.5.11, 4.6.4

GHSA-3325-v43h-43rv · CVE-2026-102904 Not analysed yet 1 Oct 2026
CVE-2026-103757 CVE record

CVSS 8.3 High

Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation
- budibase
- Server-side request forgery (SSRF)
Not analysed yet 1 Oct 2026
CVE-2026-103291 CVE record

CVSS 5.3 Medium

Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch
- Ghost
- Server-side request forgery (SSRF)
Not analysed yet 1 Oct 2026
CVE-2026-103082 CVE record

CVSS 7.2 High

WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability
- LA-Studio Element Kit for Elementor
- Server-side request forgery (SSRF)
Not analysed yet 1 Oct 2026
CVE-2026-103497 CVE record

CVSS 5.5 Medium

Server-side request forgery in JetBrains YouTrack
- JetBrains YouTrack
- Server-side request forgery (SSRF)
Not analysed yet 1 Oct 2026
CVE-2026-103542 CVE record

CVSS 5.3 Medium

formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery
- formtools.org Form Tools
- Server-side request forgery (SSRF)
Not analysed yet 1 Oct 2026
CVE-2026-103530 CVE record

CVSS 6.9 Medium

decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
- decolua 9Router
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
@astrojs/netlify npm

CVSS 6.3 Medium

Astro: Netlify Image CDN allowlist bypass enables SSRF
- Server-side request forgery (SSRF)
- CWE-625
>=5.2.0, <8.2.4 · fixed in 8.2.4

GHSA-4233-jc72-56c5 · CVE-2026-102983 Not analysed yet 30 Sept 2026
litellm PyPI

CVSS 6.5 Medium

LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters
- Server-side request forgery (SSRF)
<1.88.6 || >=1.89.0, <1.89.7 || >=1.90.0, <1.90.7 || >=1.91.0, <1.91.5 || >=1.92.0, <1.92.2 || >=1.93.0, <1.93.2 || >=1.94.0, <1.94.3 || >=1.95.0, <1.95.1 || >=1.96.0, <1.96.2 · fixed in 1.88.6, 1.89.7, 1.90.7, 1.91.5, 1.92.2, 1.93.2, 1.94.3, 1.95.1, 1.96.2

GHSA-3cv6-jpf6-8222 · CVE-2026-84377 Not analysed yet 30 Sept 2026
CVE-2026-102105 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Kiteworks Email Protection Gateway server-side request forgery
- Kiteworks Email Protection Gateway
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2023-54402 CVE record

CVSS 8.7 High

iDocView SSRF via /doc/upload Endpoint Hardcoded Token
- iDocView
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-102104 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Kiteworks Email Protection Gateway server-side request forgery
- Kiteworks Email Protection Gateway
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-102103 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Kiteworks Email Protection Gateway server-side request forgery
- Kiteworks Email Protection Gateway
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-102102 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Kiteworks Email Protection Gateway server-side request forgery
- Kiteworks Email Protection Gateway
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-102138 CVE record

CVSS 3.3 Low

Kiteworks Core Server-Side Request Forgery (SSRF)
- Kiteworks Core
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-102095 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Kiteworks Email Protection Gateway server-side request forgery
- Kiteworks Email Protection Gateway
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-102091 CVE record

CVSS 7.5 High

Kiteworks Secure Data Forms server-side request forgery
- Kiteworks Secure Data Forms
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-101883 CVE record

CVSS 5.3 Medium

OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present
- OpenClaw Windows Node
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-62308 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint
- Quenary tugtainer
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-100279 CVE record

CVSS 6.5 Medium

Server-side request forgery in JetBrains YouTrack
- JetBrains YouTrack
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-100257 CVE record

CVSS 4.3 Medium

Server-side request forgery in JetBrains YouTrack
- JetBrains YouTrack
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
axios npm

CVSS 7.0 High

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
- Server-side request forgery (SSRF)
>=1.13.0, <1.20.0 · fixed in 1.20.0

GHSA-3pq3-5fj3-cg6v · CVE-2026-101898 Not analysed yet 30 Sept 2026
CVE-2026-103243 CVE record

CVSS 6.9 Medium

LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints
- ModelTC LightLLM
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-102577 CVE record

CVSS 4.3 Medium

Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
CVE-2026-97316 CVE record

CVSS 5.8 Medium

Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass
- Broken Link Notifier
- Server-side request forgery (SSRF)
Not analysed yet 30 Sept 2026
pyjwt PyPI

CVSS 7.4 High

PyJWT: PyJWKClient follows redirects when fetching JWKS
- Information disclosure
- Server-side request forgery (SSRF)
<2.14.0 · fixed in 2.14.0

GHSA-9v7f-9g4p-ffgj · CVE-2026-102267 Not analysed yet 29 Sept 2026
CVE-2026-102879 CVE record

CVSS 5.3 Medium

ClaraVerse through 0.3.1 SSRF Protection Bypass
- ClaraVerse
- Server-side request forgery (SSRF)
Not analysed yet 29 Sept 2026
CVE-2026-102877 CVE record

CVSS 2.1 Low

Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
- fider
- Server-side request forgery (SSRF)
Not analysed yet 29 Sept 2026
CVE-2026-100297 CVE record

CVSS 6.9 Medium

Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5
- Anjvision YSSD-RTMP-H5
- Server-side request forgery (SSRF)
Not analysed yet 29 Sept 2026
CVE-2026-76728 CVE record

CVSS 7.2 High

Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs
- Hewlett Packard Enterprise (HPE) Instant ON
- Server-side request forgery (SSRF)
Not analysed yet 29 Sept 2026
CVE-2026-102722 CVE record

CVSS 6.9 Medium

The FTP client trusts arbitrary IP addresses in the PASV server response
- Eclipse Foundation Eclipse ThreadX NetX Duo
- Server-side request forgery (SSRF)
Not analysed yet 29 Sept 2026
CVE-2026-92222 CVE record

CVSS 8.9 High

Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Server-side request forgery (SSRF)
Not analysed yet 29 Sept 2026
CVE-2026-102244 CVE record

CVSS 5.3 Medium

MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery
- MODSetter SurfSense
- Server-side request forgery (SSRF)
Not analysed yet 29 Sept 2026
ip-address npm

CVSS 6.3 Medium

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
- Server-side request forgery (SSRF)
- CWE-697
<10.5.1 · fixed in 10.5.1

GHSA-rpw4-54j3-4h4q · CVE-2026-101913 Not analysed yet 28 Sept 2026
ip-address npm

CVSS 6.9 Medium

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
- Server-side request forgery (SSRF)
>=10.2.0, <10.5.1 · fixed in 10.5.1

GHSA-2vr4-cq9g-pvrc · CVE-2026-101910 Not analysed yet 28 Sept 2026
com.fasterxml.jackson.core:jackson-databind +1 Maven

CVSS 5.3 Medium

jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization
- Server-side request forgery (SSRF)
>=2.0.0, <2.18.9 || >=2.19.0, <2.21.5 || >=2.22.0, <2.22.1 · fixed in 2.18.9, 2.21.5, 2.22.1

GHSA-vvgp-rfg2-7rr6 · CVE-2026-77310 Not analysed yet 28 Sept 2026
CVE-2026-55160 CVE record

CVSS 7.6 High

Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer
- stringer
- Server-side request forgery (SSRF)
Not analysed yet 28 Sept 2026
CVE-2026-55096 CVE record

CVSS 7.1 High

SSRF via DNS-resolution gap in _validate_url_security (file download by URL)
- leshchenko1979 fast-mcp-telegram
- Server-side request forgery (SSRF)
- CWE-184
Not analysed yet 28 Sept 2026
CVE-2026-82375 CVE record

CVSS 7.4 High

Apache Roller: Server-side request forgery via entry trackback and enclosure URLs
- Apache Software Foundation Apache Roller
- Server-side request forgery (SSRF)
Not analysed yet 28 Sept 2026
CVE-2026-100750 CVE record

CVSS 8.5 High

Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla
- regularlabs.com Modules Anywhere (Pro) extension for Joomla
- Server-side request forgery (SSRF)
Not analysed yet 28 Sept 2026
CVE-2026-101005 CVE record

CVSS 6.9 Medium

October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery
- October CMS
- Server-side request forgery (SSRF)
Not analysed yet 28 Sept 2026
CVE-2026-100901 CVE record

CVSS 6.9 Medium

athlon1600 youtube-downloader stream.php stream server-side request forgery
- athlon1600 youtube-downloader
- Server-side request forgery (SSRF)
Not analysed yet 28 Sept 2026
CVE-2026-100900 CVE record

CVSS 5.1 Medium

DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery
- DevaslanPHP project-management
- Server-side request forgery (SSRF)
Not analysed yet 28 Sept 2026
CVE-2026-100893 CVE record

CVSS 6.9 Medium

Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery
- Privoce VoceChat Server
- Server-side request forgery (SSRF)
Not analysed yet 28 Sept 2026
CVE-2026-101087 CVE record

CVSS 5.3 Medium

Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6
- nezha
- Server-side request forgery (SSRF)
Not analysed yet 27 Sept 2026
CVE-2026-101061 CVE record

CVSS 2.3 Low

utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass
- universal-tool-calling-protocol python-utcp
- Server-side request forgery (SSRF)
Not analysed yet 27 Sept 2026
CVE-2026-101060 CVE record

CVSS 8.4 High

python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects
- universal-tool-calling-protocol python-utcp
- Server-side request forgery (SSRF)
Not analysed yet 27 Sept 2026
CVE-2026-101059 CVE record

CVSS 7.1 High

utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass
- universal-tool-calling-protocol python-utcp
- Server-side request forgery (SSRF)
Not analysed yet 27 Sept 2026
CVE-2026-101058 CVE record

CVSS 7.1 High

python-utcp before 1.1.12 SSRF via Remote HTTP Manual
- universal-tool-calling-protocol python-utcp
- Server-side request forgery (SSRF)
Not analysed yet 27 Sept 2026
CVE-2026-89003 CVE record

CVSS 4.1 Medium

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview
- WPeMatico RSS Feed Fetcher
- Server-side request forgery (SSRF)
Not analysed yet 27 Sept 2026
CVE-2026-89000 CVE record

CVSS 4.1 Medium

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run
- WPeMatico RSS Feed Fetcher
- Server-side request forgery (SSRF)
Not analysed yet 27 Sept 2026
CVE-2026-100863 CVE record

CVSS 5.3 Medium

Heym before 0.0.91 SSRF via image fetching and IPv6 validation
- heym
- Server-side request forgery (SSRF)
Not analysed yet 27 Sept 2026
CVE-2026-100861 CVE record

CVSS 5.3 Medium

heym before 0.0.105 SSRF via credential-controlled base URLs
- heym
- Server-side request forgery (SSRF)
Not analysed yet 27 Sept 2026
CVE-2026-100859 CVE record

CVSS 7.1 High

Heym before 0.0.106 Credential Exfiltration via URL Override
- heym
- Server-side request forgery (SSRF)
Not analysed yet 27 Sept 2026