Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
SPIP before 4.4.18 SSRF via HTTP Redirects in recuperer_url
- SPIP
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Quay: quay: webhook notification ssrf -- hostname-string blocklist trivially bypassable
- mirror registry for Red Hat OpenShift
- mirror registry for Red Hat OpenShift 2
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.14
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Server-side request forgery and hard-coded key in Progress MarkLogic Server OpsDirector
- Progress Software Corporation MarkLogic Server
- Hard-coded credentials
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch
- unclecode crawl4ai
- Server-side request forgery (SSRF)
- CVSS 9.2 CriticalCritical · CVSS 9+
Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder
- unclecode crawl4ai
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Server-side request forgery in Progress MarkLogic Server Linux cloud deployments
- Progress Software Corporation MarkLogic Server
- Server-side request forgery (SSRF)
- CVSS 8.5 High
Server-side request forgery in Progress MarkLogic Server Azure deployments
- Progress Software Corporation MarkLogic Server
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href
- LogicalDOC Community Edition
- Server-side request forgery (SSRF)
- CVSS 4.0 Medium
Untrusted request routing and forged acknowledgements permit copy-workflow manipulation in Progress ShareFile Storage Zones Controller
- Progress ShareFile Storage Zones Controller
- Hard-coded credentials
- Race condition
- CVSS 6.5 Medium
Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller
- Progress ShareFile Storage Zones Controller
- Authentication bypass
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Ollama Pull API name.go IsValid server-side request forgery
- Ollama
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
houtini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery
- houtini-ai voice-analyser-mcp
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request forgery
- houtini-ai seo-crawler-mcp
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery
- Appwrite
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup
- guy-hartstein company-research-agent
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Miniflux 2.3.0 through 2.3.3 SSRF via Per-Feed Proxy URL
- miniflux
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url
- theopenco LLMGateway
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery
- Casdoor
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
021is elvix-sdk MCP Request index.ts server-side request forgery
- 021is elvix-sdk
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery
- Studio-Saelix Sencho
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery
- Studio-Saelix Sencho
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution
- helicone
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability
- Builderius
- Server-side request forgery (SSRF)
- CVSS 7.2 High
WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability
- bPlugins StreamCast
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch
- mealie
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool
- 54yyyu zotero-mcp
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input
- PDFMathTranslate
- Server-side request forgery (SSRF)
- CVSS 2.3 Low
Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses
- kortix-ai suna
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
- Server-side request forgery (SSRF)
<=0.5.0b3.dev101 · no fixed version yet
GHSA-p3pr-8f3m-4qp8 - CVSS 5.3 Medium
Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)
- Grid Protection Alliance openPDC
- Grid Protection Alliance openPDC (Docker image)
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager
- Dell Secure Connect Gateway (SCG) Policy Manager
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager
- Dell Secure Connect Gateway (SCG) Policy Manager
- Server-side request forgery (SSRF)
- CVSS 4.1 Medium
Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL
- Kirki
- Server-side request forgery (SSRF)
- CVSS 9.6 CriticalCritical · CVSS 9+
Azure SRE Agent Elevation of Privilege Vulnerability
- Microsoft Azure SRE Agent
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Indico: Incomplete Server-Side Request Forgery (SSRF) check
- Server-side request forgery (SSRF)
<3.3.13 · fixed in 3.3.13
GHSA-2v95-h47v-g4x9 · CVE-2026-107394 - CVSS 6.9 Medium
PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF
- Information disclosure
- Authentication bypass
<4.6.78 · fixed in 4.6.78
GHSA-4w49-gwv8-fpjg · CVE-2026-60091 - CVSS 9.1 CriticalCritical · CVSS 9+
Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
- dromara skyeye
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
- FFmpeg
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Server-Side Request Forgery in Malcolm
- CISA Malcolm
- Server-side request forgery (SSRF)
- CVSS 6.8 Medium
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
- Server-side request forgery (SSRF)
- CWE-1289
>=1.56.0, <1.107.6 || >=2.0.0b1, <2.44.0 · fixed in 1.107.6, 2.44.0
GHSA-vmxc-h2x2-jmf3 · CVE-2026-107289 - CVSS 8.4 High
PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure
- Information disclosure
- Race condition
<1.6.78 · fixed in 1.6.78
GHSA-qg25-6gc4-48mg · CVE-2026-61430 - CVSS 3.7 Low
Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently
- pydantic-ai
- pydantic-ai-slim
- Server-side request forgery (SSRF)
- CWE-1289
- CVSS 4.9 Medium
IBM DataPower Gateway affected by server-side request forgery
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Server-side request forgery (SSRF)
- CVSS 3.4 Low
Server-side request forgery in linuxserver Heimdall
- linuxserver Heimdall
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server
- Splunk MCP Server
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud
- Splunk Enterprise
- Server-side request forgery (SSRF)
- CVSS 4.0 Medium
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
- Race condition
- Server-side request forgery (SSRF)
>=2.91.0, <2.132.0 · fixed in 2.132.0
GHSA-pc36-qwjq-x68c · CVE-2026-105743 - CVSS 4.0 Medium
Ghost: Server-Side Request Forgery in Bookmark Fetching
- Race condition
- Server-side request forgery (SSRF)
>=6.54.1, <6.65.0 · fixed in 6.65.0
GHSA-322m-ff4g-9vx9 · CVE-2026-105647 - CVSS 4.0 Medium
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
- Server-side request forgery (SSRF)
- CWE-184
>=6.0.9, <6.65.0 · fixed in 6.65.0
GHSA-r7f2-6fj8-6fg2 · CVE-2026-105648 - CVSS 8.3 High
Next.js has Server-Side Request Forgery in Image Optimization
- Server-side request forgery (SSRF)
>=16.0.0, <16.3.8 · fixed in 16.3.8
GHSA-cjq9-62q9-8jv4 · CVE-2026-94483 - CVSS 7.7 High
Backstage: Improper validation of MkDocs plugin configuration in TechDocs
- Server-side request forgery (SSRF)
>=0.11.12, <1.14.7 || >=1.15.0, <1.15.5 · fixed in 1.14.7, 1.15.5
GHSA-q38j-6vcm-2f5m · CVE-2026-106455 - CVSS 8.5 High
Backstage: Improper input validation in Sentry scaffolder actions
- Information disclosure
- Server-side request forgery (SSRF)
>=0.3.0, <0.3.8 · fixed in 0.3.8
GHSA-g734-fhp4-7mfp · CVE-2026-106459 - CVSS 8.4 High
PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass
- Information disclosure
- Race condition
<1.6.78 · fixed in 1.6.78
GHSA-6g59-gm2v-qhvq · CVE-2026-61429 - CVSS 7.7 High
Backstage: Improper URL validation in catalog entity placeholder resolution
- Broken access control
- Server-side request forgery (SSRF)
<3.9.1 · fixed in 3.9.1
GHSA-qgvj-qcf8-xq73 · CVE-2026-106498 - CVSS 7.7 High
Backstage has improper input validation in TechDocs Markdown extension configuration
- Path traversal
- Server-side request forgery (SSRF)
<1.15.4 · fixed in 1.15.4
GHSA-f7v3-xhm6-w245 · CVE-2026-106557 - CVSS 5.1 Medium
Ghost: Server-Side Request Forgery in Webhook Trigger
- Server-side request forgery (SSRF)
>=1.18.0, <6.27.0 · fixed in 6.27.0
GHSA-354h-gmhv-mr9c · CVE-2026-103287 - CVSS 7.2 High
Cisco Finesse Server-Side Request Forgery Vulnerability
- Cisco Finesse
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site
- gophish
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Server-side request forgery in SonicWall SMA1000
- SonicWall SMA1000
- Server-side request forgery (SSRF)
- CWE-441