CWE-918 · Server-Side Request Forgery (SSRF) (page 3)
Page 3 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59931 | High | 7.7 | 2026-07-28 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0… |
CVE-2026-54605 | High | 7.2 | 2026-07-28 | OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw… |
CVE-2026-43910 | High | 8.2 | 2026-07-28 | Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnec… |
CVE-2026-67173 | | 2026-07-28 | Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to sup… | |
CVE-2026-65442 | High | 7.2 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions. |
CVE-2026-61953 | High | 7.2 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions. |
CVE-2026-65925 | Medium | 6.5 | 2026-07-27 | A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. |
CVE-2026-65924 | Medium | 6.5 | 2026-07-27 | JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if a… |
CVE-2026-65923 | Medium | 6.8 | 2026-07-27 | A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended… |
CVE-2026-65618 | Medium | 6.5 | 2026-07-27 | Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potent… |
CVE-2026-64649 | Medium | 6.5 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forw… |
CVE-2026-16481 | | 2026-07-27 | A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. … | |
CVE-2026-64645 | Medium | 6.1 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirect… |
CVE-2026-54272 | | 2026-07-27 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through miscl… | |
CVE-2026-48051 | Low | 3.5 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass… |
CVE-2026-17552 | Critical | 9.1 | 2026-07-27 | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base i… |
CVE-2026-17192 | High | 8.5 | 2026-07-27 | A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal service… |
CVE-2026-66437 | Medium | 4.9 | 2026-07-27 | Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions. |
CVE-2026-65558 | Medium | 5.4 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions. |
CVE-2026-59552 | High | 7.2 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions. |
CVE-2026-17534 | Medium | 5.5 | 2026-07-27 | Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, with… |
CVE-2025-15662 | High | 8.6 | 2026-07-27 | The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side… |
CVE-2026-17458 | Medium | 6.3 | 2026-07-26 | A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the c… |
CVE-2026-57106 | Critical | 10.0 | 2026-07-24 | Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-16910 | Medium | 5.5 | 2026-07-24 | A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF val… |
CVE-2026-16870 | High | 8.8 | 2026-07-24 | Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stac… |
CVE-2026-56167 | High | 8.5 | 2026-07-24 | Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. |
CVE-2026-63313 | High | 7.7 | 2026-07-23 | 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url par… |
CVE-2026-21653 | | 2026-07-23 | Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and v… | |
CVE-2026-48013 | Medium | 4.1 | 2026-07-23 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to mak… |
CVE-2026-65516 | High | 7.2 | 2026-07-23 | Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions. |
CVE-2026-65496 | Medium | 4.4 | 2026-07-23 | Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions. |
CVE-2026-65467 | Medium | 4.9 | 2026-07-23 | Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions. |
CVE-2026-65466 | Medium | 4.9 | 2026-07-23 | Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions. |
CVE-2026-24639 | Medium | 4.4 | 2026-07-23 | Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions. |
CVE-2026-64873 | Critical | 9.8 | 2026-07-23 | Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services. |
CVE-2026-64799 | High | 7.5 | 2026-07-23 | Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could r… |
CVE-2026-13192 | Medium | 6.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authentic… |
CVE-2026-65593 | Medium | 5.4 | 2026-07-22 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authori… |
CVE-2026-65318 | High | 8.6 | 2026-07-21 | Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the ba… |
CVE-2026-65317 | High | 8.6 | 2026-07-21 | Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthentica… |
CVE-2026-65057 | Critical | 9.3 | 2026-07-21 | Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP reque… |
CVE-2026-65056 | High | 8.2 | 2026-07-21 | mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, lin… |
CVE-2026-63764 | High | 8.6 | 2026-07-21 | LMDeploy through 0.14.0, fixed in commit 03c3130, contains a server-side request forgery (SSRF) vulnerability in the _load_http_url function within the connect… |
CVE-2026-47695 | | 2026-07-21 | CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API (`http.req… | |
CVE-2026-46556 | Medium | 6.5 | 2026-07-21 | FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery (SSRF) vulnerability in ge… |
CVE-2026-47390 | Medium | 5.5 | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, `spider_tools` URL validatio… |
CVE-2026-15927 | Medium | 6.8 | 2026-07-21 | A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an external_refer… |
CVE-2026-64626 | Medium | 6.4 | 2026-07-20 | AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an un… |
CVE-2026-51031 | High | 7.5 | 2026-07-20 | FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain… |
CVE-2026-44583 | Medium | 5.3 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/pa… |
CVE-2026-63769 | High | 7.7 | 2026-07-20 | Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport that allows authenticated users to mak… |
CVE-2026-63731 | High | 7.7 | 2026-07-20 | HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal de… |
CVE-2026-63730 | Medium | 5.0 | 2026-07-20 | HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbi… |
CVE-2026-63107 | High | 7.7 | 2026-07-20 | LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated us… |
CVE-2026-60033 | | 2026-07-20 | Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to an SSRF vulnerability… | |
CVE-2026-45709 | Medium | 5.8 | 2026-07-20 | Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-23845, "Server-Side Request Forgery (SSRF) via HTML Check AP… |
CVE-2026-62418 | High | 8.1 | 2026-07-20 | Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apac… |
CVE-2026-63744 | Medium | 4.1 | 2026-07-20 | SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targ… |
CVE-2026-63743 | Medium | 6.4 | 2026-07-20 | SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-ne… |
CVE-2026-63736 | Medium | 4.1 | 2026-07-20 | SurrealDB before 3.2.0 contains a server-side request forgery vulnerability in the JWKS fetcher that validates only the URL hostname string against allow-lists… |
CVE-2026-16223 | Medium | 6.3 | 2026-07-19 | A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/s… |
CVE-2026-16222 | Medium | 6.3 | 2026-07-19 | A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/i… |
CVE-2026-16196 | Medium | 6.3 | 2026-07-18 | A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Impacted is the function isPrivateOrRestrictedIP of the file pkg/tools/integration/web.go of the… |
CVE-2026-16194 | Medium | 6.3 | 2026-07-18 | A vulnerability was determined in zhayujie CowAgent up to 2.1.1. This affects the function WebFetch.execute of the file agent/tools/web_fetch/web_fetch.py. Exe… |
CVE-2026-16128 | High | 7.3 | 2026-07-18 | A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the com… |
CVE-2026-16127 | High | 7.3 | 2026-07-18 | A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of the file claw/tools/tool_net.c of the com… |
CVE-2026-16125 | High | 7.3 | 2026-07-18 | A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c… |
CVE-2026-16124 | Medium | 6.3 | 2026-07-18 | A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file interna… |
CVE-2025-71398 | | 2026-07-18 | SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to block… | |
CVE-2026-16084 | High | 7.3 | 2026-07-18 | A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch of the file pkg/tools/integration/web.go. This manipulation… |
CVE-2026-54242 | Medium | 4.9 | 2026-07-17 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/Remot… |
CVE-2026-53727 | | 2026-07-17 | css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @impor… | |
CVE-2026-16074 | Medium | 6.3 | 2026-07-17 | A vulnerability was detected in AstrBotDevs AstrBot up to 4.25.2. This affects the function update_plugin/update_all_plugins of the file astrbot/dashboard/rout… |
CVE-2026-7754 | High | 7.7 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforc… |
CVE-2026-51833 | High | 7.5 | 2026-07-17 | Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can enumerate internal services (ports) or… |
CVE-2026-50151 | High | 7.5 | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-… |
CVE-2026-48978 | | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge with… | |
CVE-2026-63096 | Medium | 5.8 | 2026-07-17 | Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS con… |
CVE-2026-16016 | High | 7.3 | 2026-07-17 | A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run_task of the file executor/app/api/v1/task.py. The manipula… |
CVE-2026-62234 | High | 8.1 | 2026-07-17 | Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with… |
CVE-2026-62227 | High | 7.7 | 2026-07-17 | OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destin… |
CVE-2026-62226 | High | 8.5 | 2026-07-17 | OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL chec… |
CVE-2026-62216 | Medium | 5.0 | 2026-07-17 | OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the me… |
CVE-2026-62201 | High | 7.7 | 2026-07-17 | OpenClaw versions before 2026.6.6 contain a network policy bypass vulnerability in the sandbox exec-server that allows lower-trust callers to reach internal ne… |
CVE-2026-44023 | High | 8.6 | 2026-07-16 | Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling… |
CVE-2026-46404 | Medium | 6.8 | 2026-07-16 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link loc… |
CVE-2026-63088 | High | 8.6 | 2026-07-16 | stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-… |
CVE-2026-63086 | High | 8.6 | 2026-07-16 | text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compatible multimodal chat completions endpoi… |
CVE-2026-59867 | High | 7.1 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local abs… |
CVE-2026-63306 | High | 8.6 | 2026-07-16 | stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs wit… |
CVE-2026-53446 | | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user input and later fet… | |
CVE-2026-56678 | Medium | 6.4 | 2026-07-15 | 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-co… |
CVE-2026-15746 | Medium | 6.5 | 2026-07-15 | Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK… |
CVE-2026-53513 | Critical | 9.6 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the @better-auth/sso plugin's POST /sso/register and POST /sso/upda… |
CVE-2026-47160 | Medium | 5.8 | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's /icons/{domain}/icon.png endpoint used src/http_client.rs checks i… |
CVE-2026-45806 | High | 7.7 | 2026-07-15 | Penpot is an open-source design tool for design and code collaboration. Prior to 2.15.0, Penpot's remote image import passed the user-controlled url from front… |
CVE-2026-61835 | High | 7.7 | 2026-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL featur… |
CVE-2026-61646 | | 2026-07-15 | FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing… | |
CVE-2026-54562 | Medium | 6.5 | 2026-07-15 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4… |