Advisories · Weakness
Server-side request forgery (SSRF).
The server made to send requests an attacker chooses. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.3 Medium
phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
- phpMyAdmin
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Freelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-213
- Drupal Freelinking
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Boundary vulnerable to server-side request forgery in Vault credential store
- HashiCorp Boundary
- HashiCorp Boundary Enterprise
- Server-side request forgery (SSRF)
- CVSS 6.1 Medium
Botan: Online OCSP redirects enable blind requests to internal HTTP services
- randombit botan
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
- unclecode crawl4ai
- Server-side request forgery (SSRF)
- CVSS 5.0 Medium
Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Server-Side Request Forgery in BMC ITSM SmartIT
- BMC IT Service Management Suite
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects
- WebToffee Product Import Export for WooCommerce
- Server-side request forgery (SSRF)
- CVSS 4.8 Medium
Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name
- Apache Software Foundation Apache Camel
- Server-side request forgery (SSRF)
- CVSS 7.5 High
SSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service
- Foxit Software Inc. foxit.com
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery
- dfm feedfinder2
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
maotoumao MusicFreeDesktop Request Forwarder server-side request forgery
- maotoumao MusicFreeDesktop
- Server-side request forgery (SSRF)
- CVSS 8.6 High
AVideo-Encoder: unauthenticated full-response server-side request forgery
- WWBN AVideo-Encoder
- Server-side request forgery (SSRF)
- CVSS 6.2 Medium
Blombooru: administrator image-proxy server-side request forgery
- mrblomblo blombooru
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
- Server-side request forgery (SSRF)
<21.0.0 · fixed in 21.0.0
GHSA-c8p4-j97h-3vg8 · CVE-2026-118660 - CVSS 7.5 High
@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy
- capricorn86 happy-dom
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Kserve: kserve: server-side request forgery via malicious storageuri
- Red Hat OpenShift AI (RHOAI)
- Server-side request forgery (SSRF)
- CVSS 8.2 High
mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6
- Server-side request forgery (SSRF)
<1.4.0 · fixed in 1.4.0
GHSA-4mfg-r38w-w8fg - CVSS 4.7 Medium
Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)
- endatix
- Server-side request forgery (SSRF)
- CVSS 8.3 High
Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
- WSO2 API Manager
- WSO2 Identity Server as Key Manager
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger
- n8n
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Azure Monitor access token disclosure via SSRF
- Grafana Enterprise
- Grafana OSS
- Hard-coded credentials
- Server-side request forgery (SSRF)
- CVSS 4.2 Medium
HCL BigFix AEX is affected by multiple security vulnerabilities.
- HCL Software BigFix AEX
- Server-side request forgery (SSRF)
- CWE-441
- CVSS 5.8 Medium
Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup
- Customer Engagement System
- Server-side request forgery (SSRF)
- CVSS 6.0 Medium
WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses
- Tencent WeKnora
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
- Server-side request forgery (SSRF)
>=1.10.0, <1.30.0 || >=2.0.0, <2.2.0 · fixed in 1.30.0, 2.2.0
GHSA-rwrf-2pqf-9j8j · CVE-2026-116686 - CVSS 6.1 Medium
CVE-2026-118172
- Strapi Open Source and Enterprise Headless CMS
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Homebox generic notifier SSRF via HTTP redirect after URL validation
- sysadminsmedia homebox
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs
- dani-garcia vaultwarden
- Server-side request forgery (SSRF)
- CVSS 4.6 Medium
Server-side request forgery in Nextcloud whiteboard
- Nextcloud whiteboard
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
- Server-side request forgery (SSRF)
>=1.6.0, <1.9.0 · fixed in 1.9.0
GHSA-x4rv-c3wx-4cr8 · CVE-2026-114620 - CVSS 6.4 Medium
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
- Broken access control
- Server-side request forgery (SSRF)
<1.30.7 || >=2.0.0, <2.1.19 || >=2.2.0, <2.4.8 || >=3.3.0, <3.10.8 || >=4.0.0, <5.10.0 · fixed in 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
GHSA-2phh-27fw-q4gc · CVE-2026-108360 - CVSS 5.8 Medium
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
- Server-side request forgery (SSRF)
<2.8.8 · fixed in 2.8.8
GHSA-rw7v-4hrq-x6r9 · CVE-2026-114609 - CVSS 6.9 Medium
Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch
- Artalk
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Server-side request forgery in NVIDIA TensorRT-LLM
- NVIDIA TensorRT-LLM
- Server-side request forgery (SSRF)
- CVSS 7.1 High
Server-side request forgery in NVIDIA TensorRT-LLM
- NVIDIA TensorRT-LLM
- Server-side request forgery (SSRF)
- CVSS 5.8 Medium
Server-side request forgery in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
User-controlled Duo host permits authenticated SSRF in Psono Server
- esaqa GmbH Psono
- Server-side request forgery (SSRF)
- CVSS 8.2 High
YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 8.2 High
YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 2.7 Low
Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
- Mattermost
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
- Server-side request forgery (SSRF)
- CWE-436
>=4.0.1, <4.9.0 · fixed in 4.9.0
EEF-CVE-2026-115700 · CVE-2026-115700 - CVSS 5.1 Medium
Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery
- Kameleo
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect
- frappe builder
- Server-side request forgery (SSRF)
- CVSS 6.3 Medium
Frappe Builder before 1.36.1 SSRF via convert_to_webp
- frappe builder
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery
- geesondog RhaPHP
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery
- fr0tt benotes
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
EyouCMS function.php remote_file_to_local server-side request forgery
- EyouCMS
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
KodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery
- KodCloud KodExplorer
- Server-side request forgery (SSRF)
- CVSS 8.8 High
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. At...
- Server-side request forgery (SSRF)
>=0.9.2, <0.24.0 · fixed in 0.24.0
GHSA-vfp2-c8pq-v6h6 · CVE-2026-116176 - CVSS 6.9 Medium
YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax
- yeswiki
- Server-side request forgery (SSRF)
- CVSS 8.2 High
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
- rclone
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
phpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching
- thorsten phpMyFAQ
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field
- Albert-Weasker niubigeo
- Server-side request forgery (SSRF)
- CVSS 7.0 High
Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service
- Firecrawl
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery
- Zylon PrivateGPT
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
- Code injection
- Server-side request forgery (SSRF)
>=3.12.0rc0, <3.17.0 · fixed in 3.17.0
GHSA-2wqp-q3c6-ccj5 · CVE-2026-115886