CWE-918 · Server-Side Request Forgery (SSRF) (page 11)
Page 11 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33126 | Medium | 5.0 | 2026-03-20 | Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3, the /ffprobe endpoint accepts arbitrary… |
CVE-2026-33081 | Medium | 5.8 | 2026-03-20 | PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF vulnerability in the… |
CVE-2026-33060 | Medium | 5.3 | 2026-03-20 | CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools including ckan_package_search and sparql_query that accep… |
CVE-2026-33039 | High | 8.6 | 2026-03-20 | WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal… |
CVE-2026-33024 | Critical | 9.1 | 2026-03-20 | AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpoints getIm… |
CVE-2026-32949 | High | 7.5 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulner… |
CVE-2026-32812 | Medium | 6.8 | 2026-03-20 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and loca… |
CVE-2026-32828 | Medium | 4.9 | 2026-03-20 | Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9… |
CVE-2026-29107 | Medium | 5.0 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, it is possible to… |
CVE-2026-29097 | High | 7.5 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions prior to 7.15.1 and 8.9.3 contain a Server-S… |
CVE-2026-32037 | Medium | 6.0 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 fail to consistently validate redirect chains against configured mediaAllowHosts allowlists during MSTeams media downloads… |
CVE-2026-32019 | High | 7.4 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain incomplete IPv4 special-use range validation in the isPrivateIpv4() function, allowing requests to RFC-reserved ra… |
CVE-2026-33321 | High | 7.6 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounter… |
CVE-2026-32169 | Critical | 10.0 | 2026-03-19 | Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-26139 | High | 8.6 | 2026-03-19 | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-26138 | High | 8.6 | 2026-03-19 | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-26137 | Critical | 9.9 | 2026-03-19 | Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network. |
CVE-2026-26120 | Medium | 6.5 | 2026-03-19 | Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-30404 | High | 7.5 | 2026-03-19 | The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issue can be exploited t… |
CVE-2025-71259 | Medium | 4.3 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that… |
CVE-2025-71258 | Medium | 4.3 | 2026-03-19 | BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows… |
CVE-2026-31989 | High | 7.4 | 2026-03-19 | OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in web_search citation redirect resolution that uses a private-network-… |
CVE-2026-32255 | High | 8.6 | 2026-03-19 | Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and no URL validation… |
CVE-2026-4366 | Medium | 5.8 | 2026-03-18 | A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client config… |
CVE-2026-22181 | High | 7.6 | 2026-03-18 | OpenClaw versions prior to 2026.3.2 contain a DNS pinning bypass vulnerability in strict URL fetch paths that allows attackers to circumvent SSRF guards when e… |
CVE-2026-25534 | Critical | 9.1 | 2026-03-17 | ### Impact Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java UR… |
CVE-2026-4308 | Medium | 6.3 | 2026-03-17 | A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py… |
CVE-2026-4284 | Medium | 4.7 | 2026-03-16 | A vulnerability was determined in taoofagi easegen-admin up to 8f87936ac774065b92fb20aab55b274a6ea76433. This issue affects the function downloadFile of the fi… |
CVE-2026-2455 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation which… |
CVE-2026-4231 | High | 7.3 | 2026-03-16 | A vulnerability was found in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function update_sql/run_sql of the file src/vanna/legacy/flask/_… |
CVE-2026-4215 | Medium | 6.3 | 2026-03-16 | A security flaw has been discovered in FlowCI flow-core-x up to 1.23.01. The impacted element is the function Save of the file core/src/main/java/com/flowci/co… |
CVE-2026-4200 | High | 7.3 | 2026-03-16 | A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the f… |
CVE-2025-69239 | Low | 2.7 | 2026-03-16 | Raytha CMS is vulnerable to Server-Side Request Forgery in the “Themes - Import from URL” feature. It allows an attacker with high privileges to provide the UR… |
CVE-2026-32412 | Medium | 5.4 | 2026-03-13 | Server-Side Request Forgery (SSRF) vulnerability in Gift Up! Gift Up Gift Cards for WordPress and WooCommerce gift-up allows Server Side Request Forgery.This i… |
CVE-2026-32357 | Medium | 6.4 | 2026-03-13 | Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects S… |
CVE-2026-32353 | Medium | 6.4 | 2026-03-13 | Server-Side Request Forgery (SSRF) vulnerability in MailerPress Team MailerPress mailerpress allows Server Side Request Forgery.This issue affects MailerPress… |
CVE-2026-32349 | Medium | 4.9 | 2026-03-13 | Server-Side Request Forgery (SSRF) vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer allows Server Side Request Forgery.This issue affects Embed P… |
CVE-2026-32301 | Critical | 9.3 | 2026-03-13 | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configure… |
CVE-2026-32236 | High | 7.5 | 2026-03-12 | Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vulnerability exists in @backstage/plugin-… |
CVE-2026-21887 | High | 7.7 | 2026-03-12 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, the OpenCTI platform’s data ingestion fea… |
CVE-2026-3966 | Medium | 6.3 | 2026-03-12 | A vulnerability was detected in 648540858 wvp-GB28181-pro up to 2.7.4-20260107. Affected by this vulnerability is the function getDownloadFilePath of the file… |
CVE-2026-3961 | Medium | 6.3 | 2026-03-11 | A vulnerability was determined in zyddnys manga-image-translator up to beta-0.3. The affected element is the function to_pil_image of the file manga-image-tran… |
CVE-2026-3958 | Medium | 6.3 | 2026-03-11 | A vulnerability has been found in Woahai321 ListSync up to 0.6.6. This issue affects the function requests.post of the file list-sync-main/api_server.py of the… |
CVE-2026-32133 | Critical | 9.1 | 2026-03-11 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in… |
CVE-2026-32111 | Medium | 5.3 | 2026-03-11 | ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form (beta feature) accepts a user-supplied ha_url and makes a server-side HTTP… |
CVE-2026-32110 | High | 8.3 | 2026-03-11 | SiYuan is a personal knowledge management system. Prior to 3.6.0, the /api/network/forwardProxy endpoint allows authenticated users to make arbitrary HTTP requ… |
CVE-2026-32096 | Critical | 9.3 | 2026-03-11 | Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed in the SNS webhook h… |
CVE-2026-31974 | Low | 3.0 | 2026-03-11 | OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint (POST /admin/settings/mail_notifications)… |
CVE-2026-31959 | Medium | 5.3 | 2026-03-11 | Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Server-Side Request Forgery (SSRF) vulnerab… |
CVE-2026-31878 | Medium | 5.0 | 2026-03-11 | Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a crafted request to an endpoint which w… |
CVE-2025-70027 | High | 7.5 | 2026-03-11 | An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive in… |
CVE-2026-21294 | Medium | 5.5 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vuln… |
CVE-2026-21293 | Medium | 5.5 | 2026-03-11 | Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Server-Side Request Forgery (SSRF) vuln… |
CVE-2026-31829 | High | 7.1 | 2026-03-10 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflo… |
CVE-2026-30953 | High | 7.7 | 2026-03-10 | LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetches HTML metadata from the provided URL (… |
CVE-2026-27826 | High | 8.2 | 2026-03-10 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, an unauthenticated attacker who c… |
CVE-2026-26801 | High | 7.5 | 2026-03-10 | Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via th… |
CVE-2026-26121 | High | 7.5 | 2026-03-10 | Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-26118 | High | 8.8 | 2026-03-10 | Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-24316 | Medium | 6.4 | 2026-03-10 | SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external en… |
CVE-2026-25960 | High | 7.1 | 2026-03-09 | vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_… |
CVE-2026-25737 | High | 8.9 | 2026-03-09 | Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.24.0 and earlier, an arbitrary file upload vulnerability exists… |
CVE-2026-3588 | High | 7.5 | 2026-03-09 | A server-side request forgery (SSRF) vulnerability in IKEA Dirigera v2.866.4 allows an attacker to exfiltrate private keys by sending a crafted request. |
CVE-2025-70042 | Critical | 9.8 | 2026-03-09 | An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master. |
CVE-2026-3789 | Medium | 6.3 | 2026-03-09 | A vulnerability was detected in Bytedesk up to 1.3.9. Affected is the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/provide… |
CVE-2026-3788 | Medium | 6.3 | 2026-03-09 | A security vulnerability has been detected in Bytedesk up to 1.3.9. This impacts the function getModels of the file source-code/src/main/java/com/bytedesk/ai/s… |
CVE-2026-3750 | Medium | 4.7 | 2026-03-08 | A security vulnerability has been detected in ContiNew Admin up to 4.2.0. This issue affects the function URI.create of the file continew-system/src/main/java/… |
CVE-2026-3733 | Medium | 6.3 | 2026-03-08 | A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controlle… |
CVE-2026-3683 | Medium | 6.3 | 2026-03-08 | A vulnerability was detected in bufanyun HotGo up to 2.0. This issue affects the function ImageTransferStorage of the file /server/internal/logic/common/upload… |
CVE-2026-3681 | Medium | 6.3 | 2026-03-07 | A weakness has been identified in welovemedia FFmate up to 2.0.15. This affects the function fireWebhook of the file /internal/service/webhook/webhook.go. Exec… |
CVE-2026-30858 | Medium | 6.5 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a DNS rebinding vulnerability in t… |
CVE-2026-30834 | High | 7.5 | 2026-03-07 | PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vu… |
CVE-2026-30832 | Critical | 9.1 | 2026-03-07 | Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to m… |
CVE-2026-30840 | High | 8.8 | 2026-03-07 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, there is a server-side request forgery vulnerability in notifica… |
CVE-2026-30839 | Medium | 4.3 | 2026-03-07 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, testwebhooknotifications.php does not validate the target URL ag… |
CVE-2026-30828 | High | 7.5 | 2026-03-07 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. Th… |
CVE-2026-27797 | Medium | 5.3 | 2026-03-07 | Homarr is an open-source dashboard. Prior to version 1.54.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to fo… |
CVE-2026-30247 | Medium | 5.9 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, the application's "Import documen… |
CVE-2026-30242 | High | 8.5 | 2026-03-06 | Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_lo… |
CVE-2026-30844 | High | 8.1 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading… |
CVE-2026-29178 | | 2026-03-06 | Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for… | |
CVE-2026-29049 | Medium | 4.3 | 2026-03-06 | melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via… |
CVE-2026-28680 | Critical | 9.3 | 2026-03-06 | Ghostfolio is an open source wealth management software. Prior to version 2.245.0, an attacker can exploit the manual asset import feature to perform a full-re… |
CVE-2026-28677 | High | 8.2 | 2026-03-06 | OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, the URL ingest pipeline a… |
CVE-2026-28508 | High | 8.6 | 2026-03-06 | Idno is a social publishing platform. Prior to version 1.6.4, a logic error in the API authentication flow causes the CSRF protection on the URL unfurl service… |
CVE-2026-28476 | High | 8.3 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base U… |
CVE-2026-28467 | Medium | 6.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.2 contain a server-side request forgery vulnerability in attachment and media URL hydration that allows remote attackers to f… |
CVE-2026-28451 | High | 8.3 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-control… |
CVE-2026-27023 | Medium | 5.0 | 2026-03-05 | Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request URLs at the request level but did not val… |
CVE-2025-45691 | High | 7.5 | 2026-03-05 | An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14. The vulnerability stems from impr… |
CVE-2026-28036 | Medium | 6.4 | 2026-03-05 | Server-Side Request Forgery (SSRF) vulnerability in SkatDesign Ratatouille ratatouille allows Server Side Request Forgery.This issue affects Ratatouille: from… |
CVE-2026-3125 | Medium | 6.5 | 2026-03-04 | A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn… |
CVE-2026-1273 | High | 7.2 | 2026-03-04 | The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up… |
CVE-2026-27600 | Medium | 5.0 | 2026-03-03 | HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, the notifier functionality allows authenticated users to specify arbitrary URLs to w… |
CVE-2025-64427 | High | 7.1 | 2026-03-02 | ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or re… |
CVE-2025-50199 | Critical | 9.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This is… |
CVE-2024-50337 | Medium | 5.3 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to any URL on server's behalf, which resu… |
CVE-2026-28423 | Medium | 6.8 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure… |
CVE-2026-27759 | | 2026-02-27 | Featured Image from Content (featured-image-from-content) WordPress plugin versions prior to 1.7 contain an authenticated server-side request forgery vulnerabi… | |
CVE-2026-28416 | High | 8.2 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio al… |