CWE-918 · Server-Side Request Forgery (SSRF) (page 10)
Page 10 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34936 | High | 7.7 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 4.5.90, passthrough() and apassthrough() in praisonai accept a caller-controlled api_base parameter t… |
CVE-2026-22664 | High | 7.7 | 2026-04-03 | prompts.chat prior to commit 30a8f04 contains a server-side request forgery vulnerability in the Fal.ai media status polling feature that allows authenticated… |
CVE-2026-22662 | Medium | 4.3 | 2026-04-03 | prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to… |
CVE-2026-28798 | Critical | 9.0 | 2026-04-03 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed… |
CVE-2026-32186 | Critical | 10.0 | 2026-04-03 | Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-5470 | Medium | 6.3 | 2026-04-03 | A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83… |
CVE-2026-31818 | Critical | 9.6 | 2026-04-03 | Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource… |
CVE-2026-5469 | Medium | 4.7 | 2026-04-03 | A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can l… |
CVE-2026-33107 | Critical | 10.0 | 2026-04-03 | Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-26135 | Critical | 9.6 | 2026-04-03 | Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network. |
CVE-2026-5418 | High | 7.3 | 2026-04-02 | A vulnerability was identified in appsmithorg appsmith up to 1.97. Impacted is the function computeDisallowedHosts of the file app/server/appsmith-interfaces/s… |
CVE-2026-5417 | Medium | 4.7 | 2026-04-02 | A vulnerability was determined in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of the file backend/apps/db/es_engine.py of… |
CVE-2026-34590 | Medium | 5.4 | 2026-04-02 | Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the… |
CVE-2026-34577 | High | 8.6 | 2026-04-02 | Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query pa… |
CVE-2026-34576 | High | 7.7 | 2026-04-02 | Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the POST /public/v1/upload-from-url endpoint accepts a user-supplied URL and fetches it… |
CVE-2026-34526 | Medium | 5.0 | 2026-04-02 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-5346 | High | 7.3 | 2026-04-02 | A vulnerability was determined in huimeicloud hm_editor up to 2.2.3. Impacted is the function client.get of the file src/mcp-server.js of the component image-t… |
CVE-2026-32871 | Critical | 10.0 | 2026-04-02 | FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by pars… |
CVE-2026-0688 | Medium | 6.4 | 2026-04-02 | The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 via the 'Tools::read' function. Th… |
CVE-2026-0686 | High | 7.2 | 2026-04-02 | The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' fun… |
CVE-2026-5323 | Medium | 5.3 | 2026-04-02 | A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation res… |
CVE-2026-34515 | High | 7.5 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose info… |
CVE-2026-34746 | High | 7.7 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerabilit… |
CVE-2026-34076 | High | 7.4 | 2026-04-01 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. In @clerk/hono from versions 0.1.0 to before 0.1.5, @clerk/express from versio… |
CVE-2026-33990 | Critical | 9.1 | 2026-04-01 | Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior to version 1.1.25, Docker Model Runner contains an SSRF vul… |
CVE-2026-20041 | Medium | 6.1 | 2026-04-01 | A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attacker to conduct a server-side request fo… |
CVE-2026-4989 | Medium | 4.3 | 2026-04-01 | Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request f… |
CVE-2026-0932 | High | 7.3 | 2026-04-01 | Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an un… |
CVE-2026-5259 | Medium | 6.3 | 2026-04-01 | A vulnerability was determined in AutohomeCorp frostmourne up to 1.0. The affected element is an unknown function of the file frostmourne-monitor/src/main/java… |
CVE-2026-34443 | Medium | 5.3 | 2026-03-31 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, checkIpByMask() in app/Misc/Helper.php checks whet… |
CVE-2026-34740 | Medium | 6.5 | 2026-03-31 | WWBN AVideo is an open source video platform. In versions 26.0 and prior, the EPG (Electronic Program Guide) link feature in AVideo allows authenticated users… |
CVE-2026-34367 | High | 7.6 | 2026-03-31 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a S… |
CVE-2026-34366 | High | 7.6 | 2026-03-31 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a S… |
CVE-2026-34365 | High | 7.6 | 2026-03-31 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a S… |
CVE-2026-33185 | Medium | 5.0 | 2026-03-31 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to b… |
CVE-2026-5205 | Medium | 6.3 | 2026-03-31 | A vulnerability was identified in chatwoot up to 4.11.2. Affected by this vulnerability is the function Webhooks::Trigger in the library lib/webhooks/trigger.r… |
CVE-2026-34360 | Medium | 5.8 | 2026-03-31 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the /loadIG HTTP endpoint in t… |
CVE-2026-34504 | High | 8.3 | 2026-03-31 | OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers… |
CVE-2026-34163 | High | 7.7 | 2026-03-31 | FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools endpoints (/api/core/app/mcpTools/getTools an… |
CVE-2026-34162 | Critical | 10.0 | 2026-03-31 | FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed witho… |
CVE-2026-3881 | Medium | 5.8 | 2026-03-31 | The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to… |
CVE-2026-34881 | Medium | 5.0 | 2026-03-31 | OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated us… |
CVE-2026-4789 | Critical | 9.8 | 2026-03-30 | Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions. |
CVE-2026-27018 | High | 7.5 | 2026-03-30 | Gotenberg is an API for converting document formats. Prior to version 8.29.0, the fix introduced for CVE-2024-21527 can be bypassed using mixed-case or upperca… |
CVE-2026-31804 | Medium | 4.0 | 2026-03-30 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied i… |
CVE-2026-29925 | High | 7.7 | 2026-03-30 | Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php. |
CVE-2026-5126 | Medium | 6.3 | 2026-03-30 | A flaw has been found in SourceCodester RSS Feed Parser 1.0. Affected by this issue is the function file_get_contents. This manipulation causes server-side req… |
CVE-2026-29954 | High | 7.6 | 2026-03-30 | In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition… |
CVE-2026-2286 | Critical | 9.8 | 2026-03-30 | CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search to… |
CVE-2026-0560 | High | 7.5 | 2026-03-29 | A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint… |
CVE-2026-5016 | High | 7.3 | 2026-03-28 | A vulnerability was identified in elecV2 elecV2P up to 3.8.3. This affects the function eAxios of the file /mock of the component URL Handler. Such manipulatio… |
CVE-2025-12886 | High | 7.2 | 2026-03-28 | The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX… |
CVE-2026-33992 | Medium | 6.5 | 2026-03-27 | pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without va… |
CVE-2026-33953 | High | 8.5 | 2026-03-27 | LinkAce is a self-hosted archive to collect website links. Versions prior to 2.5.3 block direct requests to private IP literals, but still performs server-side… |
CVE-2026-31945 | High | 7.7 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a server-side request forgery (SSRF) attack when usin… |
CVE-2026-31943 | High | 8.5 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth/domain.ts` fails to detect IPv4-mapped… |
CVE-2026-4964 | Medium | 6.3 | 2026-03-27 | A security vulnerability has been detected in letta-ai letta 0.16.4. This vulnerability affects the function _convert_message_create_to_message of the file let… |
CVE-2026-4953 | High | 7.3 | 2026-03-27 | A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/mingsoft/cms/action/BaseAction.java of… |
CVE-2026-33766 | Medium | 6.5 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before… |
CVE-2026-33205 | Medium | 5.5 | 2026-03-27 | calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a Server-Side Request Forgery vuln… |
CVE-2026-30637 | High | 7.5 | 2026-03-27 | Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before. The vulnerability allows remote… |
CVE-2026-22742 | High | 8.6 | 2026-03-27 | Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages… |
CVE-2026-4907 | Medium | 6.3 | 2026-03-27 | A vulnerability was identified in Page-Replica Page Replica up to e4a7f52e75093ee318b4d5a9a9db6751050d2ad0. The impacted element is the function sitemap.fetch… |
CVE-2026-33693 | Medium | 6.5 | 2026-03-27 | Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/ut… |
CVE-2026-33682 | Medium | 4.7 | 2026-03-26 | Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.0 running on Windows hosts have an unau… |
CVE-2026-3530 | Medium | 4.3 | 2026-03-26 | Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect /… |
CVE-2026-33644 | Medium | 4.3 | 2026-03-26 | Lychee is a free, open-source photo-management tool. Prior to version 7.5.2, the SSRF protection in `PhotoUrlRule.php` can be bypassed using DNS rebinding. The… |
CVE-2026-33619 | Medium | 4.1 | 2026-03-26 | PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.8.3 contains a server-side request forgery issue in… |
CVE-2026-33537 | Medium | 5.0 | 2026-03-26 | Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::fromUrl`) contains an incomplete IP validat… |
CVE-2026-33486 | Medium | 6.8 | 2026-03-26 | Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to v… |
CVE-2026-32857 | High | 8.6 | 2026-03-26 | Firecrawl version 2.8.0 and prior contain a server-side request forgery (SSRF) protection bypass vulnerability in the Playwright scraping service where network… |
CVE-2026-4874 | Low | 3.1 | 2026-03-26 | A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter duri… |
CVE-2026-33182 | High | 7.5 | 2026-03-26 | Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the c… |
CVE-2026-1561 | Medium | 5.4 | 2026-03-25 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSR… |
CVE-2026-1015 | Medium | 5.4 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to se… |
CVE-2025-14912 | Medium | 5.4 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to se… |
CVE-2026-24964 | Medium | 6.4 | 2026-03-25 | Server-Side Request Forgery (SSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Server Side Request Forg… |
CVE-2026-3216 | Medium | 5.0 | 2026-03-25 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue affects Drupal Canvas: from 0.0.0 before… |
CVE-2026-33347 | Medium | 6.1 | 2026-03-24 | league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an a… |
CVE-2026-33407 | Critical | 9.1 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_P… |
CVE-2026-33401 | Medium | 6.5 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the patch introduced in commit e8a513591 (CVE-2026-30840) added… |
CVE-2026-33399 | High | 7.7 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, the SSRF fix applied in version 4.6.2 for CVE-2026-30839 and CVE… |
CVE-2026-33340 | Critical | 9.1 | 2026-03-24 | LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability ha… |
CVE-2026-33679 | Medium | 6.4 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go` uses a bare `http… |
CVE-2026-33675 | Medium | 6.4 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHead… |
CVE-2026-4623 | High | 7.3 | 2026-03-24 | A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This… |
CVE-2026-32279 | Medium | 6.8 | 2026-03-23 | Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0… |
CVE-2026-33502 | Critical | 9.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in `plugin/Liv… |
CVE-2026-33480 | High | 8.6 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped… |
CVE-2026-4589 | Medium | 6.3 | 2026-03-23 | A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file /workspace/source-code/app/controller/e… |
CVE-2026-33351 | Critical | 9.1 | 2026-03-23 | WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in `plugin/Live/standAloneFiles/… |
CVE-2026-33294 | Medium | 5.0 | 2026-03-22 | WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkEmbed/save.json.php`) fetches user-suppl… |
CVE-2026-4528 | High | 7.3 | 2026-03-21 | A vulnerability was determined in trueleaf ApiFlow 0.9.7. The impacted element is the function validateUrlSecurity of the file packages/server/src/service/prox… |
CVE-2026-3478 | High | 7.2 | 2026-03-21 | The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3 via the redux_p AJA… |
CVE-2026-2290 | Low | 3.8 | 2026-03-21 | The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.28.0. This makes it possible f… |
CVE-2026-1648 | High | 7.2 | 2026-03-21 | The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.6. This is due to insuffici… |
CVE-2026-1313 | High | 8.3 | 2026-03-21 | The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20. This is due to the plu… |
CVE-2026-4302 | High | 7.2 | 2026-03-21 | The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.29. This is due… |
CVE-2026-33237 | Medium | 5.5 | 2026-03-21 | WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's `run()` function in `plugin/Scheduler/Scheduler.php` calls `url_get… |
CVE-2026-33226 | High | 8.7 | 2026-03-20 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview… |