CWE-918 · Server-Side Request Forgery (SSRF) (page 4)
Page 4 of 38 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-91081 | Medium | 5.8 | 2026-09-14 | Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by… |
CVE-2026-91079 | High | 8.5 | 2026-09-14 | Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authentic… |
CVE-2026-55073 | Medium | 6.2 | 2026-09-14 | WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-inf… |
CVE-2026-54452 | | 2026-09-14 | safeurl is a server-side request forgery protection library. Prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16… | |
CVE-2026-53708 | Medium | 6.6 | 2026-09-14 | ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior t… |
CVE-2026-90790 | Medium | 6.3 | 2026-09-14 | A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function _dispatch_notification of the file src/a2a/server/ta… |
CVE-2026-57126 | High | 8.5 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings… |
CVE-2026-57115 | Medium | 6.5 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get… |
CVE-2026-90710 | High | 7.3 | 2026-09-14 | A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/… |
CVE-2026-71198 | | 2026-09-14 | In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download impor… | |
CVE-2026-90580 | Medium | 6.3 | 2026-09-13 | A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/eval… |
CVE-2026-90769 | High | 7.7 | 2026-09-13 | Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to… |
CVE-2026-90486 | Medium | 6.3 | 2026-09-12 | A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown function… |
CVE-2026-90446 | Medium | 4.3 | 2026-09-11 | An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying s… |
CVE-2026-54166 | High | 7.1 | 2026-09-11 | Shelf is a platform for tracking physical assets. Prior to version 1.20.3, authenticated users with the `asset:import` permission can trigger server-side HTTP… |
CVE-2026-49865 | | 2026-09-11 | Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain a server-side request forgery vulnerability in their invoice PDF preview an… | |
CVE-2026-89242 | High | 7.2 | 2026-09-11 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetc… |
CVE-2026-19486 | | 2026-09-11 | A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01 on Google Cloud Pl… | |
CVE-2026-82097 | High | 8.8 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery (SSRF) v… |
CVE-2026-81265 | High | 7.5 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5. |
CVE-2026-81213 | High | 8.6 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation… |
CVE-2026-81207 | High | 8.5 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project membership or role — fully controls scheme/host/port/path of an o… |
CVE-2026-79723 | Medium | 5.0 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled… |
CVE-2026-54054 | Medium | 6.5 | 2026-09-10 | Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0, Transmute's URL import endpoint, `POST /api/files/u… |
CVE-2026-9667 | Medium | 5.3 | 2026-09-10 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated attacker to cause… |
CVE-2026-89049 | Critical | 9.9 | 2026-09-10 | A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Am… |
CVE-2026-88056 | Critical | 9.1 | 2026-09-10 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22… |
CVE-2026-88896 | Medium | 5.3 | 2026-09-10 | EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to int… |
CVE-2026-88892 | Medium | 5.0 | 2026-09-10 | In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/s… |
CVE-2026-88001 | Medium | 5.0 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did not reapply WEB_FETC… |
CVE-2026-87999 | High | 7.1 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retr… |
CVE-2026-87996 | High | 7.7 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.1, SafePlaywrightURLLoader in backend/open_webui/re… |
CVE-2026-19233 | | 2026-09-09 | CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker… | |
CVE-2026-86771 | High | 7.6 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inj… |
CVE-2026-87821 | High | 7.1 | 2026-09-09 | Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authen… |
CVE-2026-79635 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vu… |
CVE-2026-57866 | High | 8.8 | 2026-09-09 | Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_generate_text() function… |
CVE-2026-54048 | Medium | 5.3 | 2026-09-09 | Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to… |
CVE-2026-19733 | Medium | 5.3 | 2026-09-09 | Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library… |
CVE-2026-80123 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vu… |
CVE-2026-87084 | High | 7.7 | 2026-09-09 | Tanium addressed a server-side request forgery vulnerability in Enforce. |
CVE-2026-87595 | Critical | 9.8 | 2026-09-09 | Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access r… |
CVE-2026-86082 | Medium | 6.5 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential allowed-domain restri… |
CVE-2026-86806 | High | 7.3 | 2026-09-08 | A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forger… |
CVE-2026-66304 | High | 7.5 | 2026-09-08 | Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network. |
CVE-2026-86074 | High | 7.1 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential test or verificatio… |
CVE-2026-81357 | High | 8.2 | 2026-09-08 | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-69904 | Low | 3.5 | 2026-09-08 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
CVE-2026-69683 | Medium | 6.5 | 2026-09-08 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
CVE-2026-69361 | Medium | 6.5 | 2026-09-08 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. |
CVE-2026-48707 | Low | 3.1 | 2026-09-08 | InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file up… |
CVE-2026-86735 | Medium | 5.0 | 2026-09-08 | snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addr… |
CVE-2026-73315 | High | 8.6 | 2026-09-08 | XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause th… |
CVE-2026-86590 | | 2026-09-08 | In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an… | |
CVE-2026-81806 | High | 7.2 | 2026-09-08 | Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from… |
CVE-2026-76971 | Medium | 6.5 | 2026-09-08 | Due to a Server-Side Request Forgery (SSRF) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could cause the server to initiate arb… |
CVE-2026-86539 | High | 7.2 | 2026-09-07 | knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to cal… |
CVE-2026-82757 | | 2026-09-07 | Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its… | |
CVE-2026-86503 | Low | 3.3 | 2026-09-07 | In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching |
CVE-2026-86321 | Medium | 5.3 | 2026-09-07 | A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/git… |
CVE-2026-86419 | Critical | 9.1 | 2026-09-07 | Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery functionality. In f… |
CVE-2026-86273 | High | 7.3 | 2026-09-07 | A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/jav… |
CVE-2026-86240 | Medium | 4.7 | 2026-09-07 | A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of th… |
CVE-2026-86237 | Medium | 5.3 | 2026-09-07 | A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test_default_model of the file sdk/src/openagents/sd… |
CVE-2026-86259 | High | 7.5 | 2026-09-06 | OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadat… |
CVE-2026-86173 | High | 7.5 | 2026-09-05 | MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary… |
CVE-2026-86123 | High | 8.7 | 2026-09-05 | SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attac… |
CVE-2026-86122 | Medium | 5.0 | 2026-09-05 | Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can poi… |
CVE-2026-86119 | High | 8.6 | 2026-09-05 | Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when… |
CVE-2026-83543 | Medium | 4.1 | 2026-09-05 | The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level acce… |
CVE-2026-4361 | Medium | 5.0 | 2026-09-05 | The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the `et_pb_set_video_oem… |
CVE-2026-86100 | Medium | 6.4 | 2026-09-05 | Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated atta… |
CVE-2026-52769 | High | 8.3 | 2026-09-05 | YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - exposed publicly with acl… |
CVE-2026-63464 | High | 7.7 | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow… |
CVE-2026-17631 | Medium | 5.0 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) v… |
CVE-2026-77822 | High | 8.2 | 2026-09-04 | IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding. |
CVE-2026-19305 | High | 8.6 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. |
CVE-2026-19304 | High | 7.7 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser di… |
CVE-2026-19301 | Medium | 5.0 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. |
CVE-2026-18905 | High | 7.7 | 2026-09-04 | IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive informati… |
CVE-2026-85699 | High | 7.5 | 2026-09-04 | jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequ… |
CVE-2026-85692 | Medium | 6.5 | 2026-09-04 | Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), contains a server-side request forgery vulnerability in the isPublicIP function in… |
CVE-2026-85691 | High | 7.5 | 2026-09-04 | MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-si… |
CVE-2026-85686 | High | 7.5 | 2026-09-04 | ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without valida… |
CVE-2026-85675 | High | 7.5 | 2026-09-04 | OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs wit… |
CVE-2026-85673 | High | 7.5 | 2026-09-04 | LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attack… |
CVE-2026-85666 | High | 7.5 | 2026-09-04 | OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/… |
CVE-2026-85662 | Medium | 5.3 | 2026-09-04 | Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthenticated attackers to trigger requests to ar… |
CVE-2026-85650 | Medium | 5.4 | 2026-09-04 | Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched without validation or SSR… |
CVE-2026-85608 | High | 7.5 | 2026-09-04 | Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_data endpoints that al… |
CVE-2026-85614 | High | 8.6 | 2026-09-04 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully clien… |
CVE-2026-85612 | High | 7.5 | 2026-09-04 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacke… |
CVE-2026-85609 | High | 7.5 | 2026-09-04 | Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api… |
CVE-2026-85528 | Medium | 5.3 | 2026-09-04 | Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login… |
CVE-2026-80181 | Critical | 9.1 | 2026-09-04 | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended t… |
CVE-2026-75754 | | 2026-09-04 | Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorize… | |
CVE-2026-85380 | High | 7.3 | 2026-09-04 | A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects t… |
CVE-2026-65818 | High | 8.5 | 2026-09-03 | Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network. |
CVE-2026-85305 | Medium | 5.4 | 2026-09-03 | Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1. |
CVE-2026-85242 | | 2026-09-03 | PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the a… |