Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
Server-side request forgery in the model download path in Amazon Web Services Multi Model Server
- AWS multi-model-server
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL
- recipes
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer
- intranda goobi-viewer-core
- Authentication bypass
- Information disclosure
- CVSS 8.9 High
@pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass
- pdfme common
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal…
- eventschedule
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Server-Side Request Forgery (SSRF) Leading to Internal Solr Data Disclosure
- onPhase Forms
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Azure AI Foundry Elevation of Privilege Vulnerability
- Microsoft Azure AI Foundry
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Authenticated Server-Side Request Forgery leads to Remote Code Execution in AOS-8
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
crawlseo before 0.2.4 Server-Side Request Forgery via Crawler
- crawlseo
- Server-side request forgery (SSRF)
- CVSS 7.2 High
Server-side request forgery in Roundcube Webmail
- Roundcube Webmail
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect
- WWBN AVideo
- Server-side request forgery (SSRF)
- CVSS 3.3 Low
SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151
- Drupal SAML SSO - Service Provider
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
- Broken access control
- Server-side request forgery (SSRF)
<2026.6.6 · fixed in 2026.6.6
GHSA-3x84-qq85-fj65 · CVE-2026-62197 - CVSS 5.3 Medium
leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery
- leomoon-studios wiki-go
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
HarnessRouter Targets Test Endpoint app.py server-side request forgery
- HarnessRouter
- Server-side request forgery (SSRF)
- CVSS 9.2 CriticalCritical · CVSS 9+
LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
- LocalAI
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
- Airbyte
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
- Airbyte
- Server-side request forgery (SSRF)
- CVSS 7.2 High
NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability
- NoMachine
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding
- Red Hat OpenShift AI (RHOAI)
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL
- triggerdotdev trigger.dev
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range
- triggerdotdev trigger.dev
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks
- sveltejs kit
- Server-side request forgery (SSRF)
- CVSS 4.7 Medium
Metasploit Framework HTTP Redirect Server-Side Request Forgery
- Rapid7 Metasploit Framework
- Server-side request forgery (SSRF)
- CVSS 4.7 Medium
Metasploit Framework FTP PASV Response SSRF
- Rapid7 Metasploit Framework
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
- a2aproject a2a-rs
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint
- bulwarkmail webmail
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
- Server-side request forgery (SSRF)
<1.3.0.Final · fixed in 1.3.0.Final
GHSA-q78c-5jjq-57g8 · CVE-2026-111761 - CVSS 4.3 Medium
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
- Server-side request forgery (SSRF)
>=1.0.0-beta.10, <1.0.0-beta.13 · fixed in 1.0.0-beta.13
GHSA-527g-ff96-x6wj · CVE-2026-113671 - CVSS 6.4 Medium
SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)
- SolarWinds Observability Self-Hosted
- Server-side request forgery (SSRF)
- CVSS 8.1 High
Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
- Red Hat streams for Apache Kafka 3
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme
- Eclipse Foundation Eclipse CSI - PIA
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
- Server-side request forgery (SSRF)
<6.0.1 || >=7.0.0, <7.0.2 · fixed in 6.0.1, 7.0.2
PKSA-ggns-sv2d-stv8 · CVE-2026-112237 - CVSS 5.4 Medium
IBM ContextForge MCP Gateway is affected by server-side request forgery
- IBM ContextForge MCP Gateway
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
MISP html_to_markdown Module SSRF via Incomplete IP Range Blocking in is_safe_url()
- misp-modules
- Server-side request forgery (SSRF)
- CWE-20
- CVSS 2.1 Low
TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery
- TiBillet Lespass
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
smrealms smr Album Website AlbumEditProcessor.php isUrlReachable server-side request forgery
- smr
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery
- ptbsare anx-calibre-manager
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery
- agit8or1 clientst0r
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo
- unclecode crawl4ai
- Server-side request forgery (SSRF)
- CVSS 8.3 High
crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool
- crewAIInc crewai-tools
- Server-side request forgery (SSRF)
- CVSS 2.1 Low
Krayin CRM 2.2.5 before 2.2.7 SSRF Filter Bypass via DNS Rebinding
- krayin laravel-crm
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker
- sgl-project sglang
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Sigma File Manager through 2.2.0 SSRF via Extension Download Commands
- aleksey-hoffman Sigma File Manager
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch
- TomBursch kitchenowl
- Server-side request forgery (SSRF)
- CVSS 8.2 High
Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address
- Apache Software Foundation Apache Camel
- Server-side request forgery (SSRF)
- CVSS 5.9 Medium
Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
- Apache Software Foundation Apache Camel
- Path traversal
- Information disclosure
- CVSS 6.5 Medium
Apache Kylin: job-driver UI proxy SSRF
- Apache Software Foundation Apache Kylin
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery
- alexta69 MeTube
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
WP Data Access < 5.5.88 - Subscriber+ SSRF
- WP Data Access
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Tandoor Recipes: Blind SSRF via AI provider URL (api_base)
- recipes
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
fish-island-backend through commit 7c61b78 SSRF via /api/web/parse
- lhccong fish-island-backend
- Server-side request forgery (SSRF)
- CVSS 9.2 CriticalCritical · CVSS 9+
Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation
- chaskiq
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint
- chaskiq
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
SparkyFitness: SSRF via unvalidated custom_url in AI service settings
- CodeWithCJ SparkyFitness
- Server-side request forgery (SSRF)
- CVSS 2.6 Low
Server-side request forgery in Devolutions Server
- Devolutions Server
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Server-Side Request Forgery in Wegow PDF export
- Wegow
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
bitcoinj Payment Request PaymentSession.java url.openConnection server-side request forgery
- bitcoinj
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
RedAmon through 7.0.1 Unauthenticated SSRF via /tradecraft/verify Endpoint
- samugit83 RedAmon
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions
- TaskingAI
- Server-side request forgery (SSRF)