CWE-918 · Server-Side Request Forgery (SSRF) (page 5)
Page 5 of 38 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-84761 | High | 7.2 | 2026-09-03 | Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions. |
CVE-2026-75036 | | 2026-09-03 | A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources… | |
CVE-2026-85180 | High | 7.5 | 2026-09-03 | Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hos… |
CVE-2026-85179 | High | 8.5 | 2026-09-03 | Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses… |
CVE-2026-85172 | Medium | 6.4 | 2026-09-03 | n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The va… |
CVE-2026-85164 | High | 7.1 | 2026-09-03 | WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails to validate profile… |
CVE-2026-85163 | Medium | 6.5 | 2026-09-03 | AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary i… |
CVE-2026-85106 | Medium | 6.3 | 2026-09-03 | A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.t… |
CVE-2026-76177 | | 2026-09-03 | Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_… | |
CVE-2026-74768 | Medium | 4.1 | 2026-09-03 | Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remo… |
CVE-2026-84377 | Medium | 6.5 | 2026-09-02 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user… |
CVE-2026-55421 | Medium | 6.8 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpoint accepts user-supplied files[].url… |
CVE-2026-66842 | High | 8.8 | 2026-09-02 | BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic… |
CVE-2026-73474 | Medium | 5.3 | 2026-09-02 | Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versi… |
CVE-2026-84772 | Medium | 5.5 | 2026-09-02 | Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions. |
CVE-2026-84175 | | 2026-09-02 | In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definitio… | |
CVE-2026-84697 | Medium | 5.3 | 2026-09-02 | Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing… |
CVE-2026-83548 | Critical | 10.0 | 2026-09-01 | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticat… |
CVE-2026-76851 | High | 8.8 | 2026-09-01 | A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient… |
CVE-2026-18730 | High | 7.4 | 2026-09-01 | A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API… |
CVE-2026-73757 | Medium | 6.4 | 2026-09-01 | A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery (SSRF) at… |
CVE-2026-8712 | High | 8.3 | 2026-09-01 | Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connecti… |
CVE-2026-84207 | Medium | 5.4 | 2026-09-01 | Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal service… |
CVE-2026-84199 | High | 7.7 | 2026-09-01 | Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration… |
CVE-2026-84196 | High | 7.7 | 2026-09-01 | Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP reques… |
CVE-2025-15613 | Medium | 6.5 | 2026-09-01 | Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (C… |
CVE-2026-83744 | Medium | 4.3 | 2026-09-01 | A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file… |
CVE-2026-82957 | High | 7.3 | 2026-08-31 | A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks… |
CVE-2026-77352 | Medium | 4.3 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user (no admin righ… |
CVE-2026-77351 | Low | 3.5 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host… |
CVE-2026-77348 | High | 8.2 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP… |
CVE-2026-82852 | Medium | 5.4 | 2026-08-31 | Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions. |
CVE-2026-81889 | High | 8.6 | 2026-08-31 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can byp… |
CVE-2026-62993 | | 2026-08-31 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the… | |
CVE-2026-61640 | | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oi… | |
CVE-2026-61638 | | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts… | |
CVE-2026-82905 | Medium | 6.3 | 2026-08-31 | A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs… |
CVE-2026-53508 | | 2026-08-31 | oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did n… | |
CVE-2026-53507 | | 2026-08-31 | oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff ac… | |
CVE-2026-79749 | | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… | |
CVE-2026-79747 | High | 7.1 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-82802 | Medium | 5.3 | 2026-08-31 | A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearc… |
CVE-2026-51152 | Critical | 9.1 | 2026-08-31 | Server-side request forgery (SSRF) in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.build_request() in libs/fetcher.py constructs an httpclie… |
CVE-2026-82801 | High | 7.3 | 2026-08-31 | A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/ha… |
CVE-2026-82866 | Medium | 6.8 | 2026-08-31 | @pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation w… |
CVE-2026-82667 | Medium | 4.7 | 2026-08-31 | A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/… |
CVE-2026-82630 | High | 7.3 | 2026-08-31 | A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob… |
CVE-2026-58301 | Medium | 6.5 | 2026-08-31 | When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connecti… |
CVE-2026-82556 | Medium | 6.3 | 2026-08-30 | A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is_migrate_allowed.go… |
CVE-2026-82638 | High | 7.5 | 2026-08-30 | jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery… |
CVE-2026-82476 | Medium | 5.3 | 2026-08-29 | Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attack… |
CVE-2026-82477 | Medium | 5.8 | 2026-08-29 | In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy end… |
CVE-2026-77012 | Critical | 9.3 | 2026-08-29 | The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default… |
CVE-2026-16947 | Critical | 9.1 | 2026-08-29 | The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side v… |
CVE-2026-16600 | High | 7.7 | 2026-08-29 | The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before… |
CVE-2026-18545 | Medium | 4.3 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized reques… |
CVE-2026-82289 | High | 7.4 | 2026-08-28 | Gitingest through 0.3.1 fails to properly validate hostnames in _validate_host, accepting any host with a git., gitlab., or github. prefix regardless of known-… |
CVE-2026-82285 | High | 8.2 | 2026-08-28 | bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication… |
CVE-2026-82270 | High | 7.5 | 2026-08-28 | Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attacke… |
CVE-2026-82268 | High | 7.5 | 2026-08-28 | Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without s… |
CVE-2026-82263 | Medium | 6.8 | 2026-08-28 | Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL par… |
CVE-2026-82262 | Medium | 6.8 | 2026-08-28 | Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host val… |
CVE-2026-55245 | | 2026-08-28 | Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached… | |
CVE-2026-54745 | Critical | 10.0 | 2026-08-28 | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an… |
CVE-2026-5096 | Medium | 5.3 | 2026-08-28 | The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previ… |
CVE-2026-82246 | High | 7.1 | 2026-08-28 | Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs befor… |
CVE-2026-82243 | High | 7.6 | 2026-08-28 | Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply… |
CVE-2026-82241 | High | 7.1 | 2026-08-28 | Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its default SSRF blacklist… |
CVE-2026-82234 | High | 8.2 | 2026-08-28 | SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution onl… |
CVE-2026-9491 | Medium | 4.3 | 2026-08-28 | A server-ide request forgery (SSRF) vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensiti… |
CVE-2026-82081 | Medium | 6.4 | 2026-08-28 | wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export. |
CVE-2026-78500 | | 2026-08-28 | A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to… | |
CVE-2026-78499 | | 2026-08-28 | A server-side request forgery (SSRF) vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate… | |
CVE-2026-78498 | | 2026-08-28 | A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerat… | |
CVE-2026-78495 | | 2026-08-28 | A server-side request forgery (SSRF) vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker… | |
CVE-2026-81848 | Low | 3.5 | 2026-08-28 | A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file sr… |
CVE-2026-59291 | Low | 2.0 | 2026-08-27 | Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring C… |
CVE-2026-55758 | | 2026-08-27 | CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to 1.120.0, the SSRF protection in projects/core/src… | |
CVE-2026-81678 | High | 7.5 | 2026-08-27 | AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64… |
CVE-2026-81093 | High | 8.6 | 2026-08-27 | The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the… |
CVE-2026-81091 | High | 8.6 | 2026-08-27 | The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/s… |
CVE-2026-75871 | High | 8.2 | 2026-08-27 | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19… |
CVE-2026-19889 | High | 8.2 | 2026-08-27 | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 1… |
CVE-2026-59278 | Medium | 6.5 | 2026-08-27 | JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default… |
CVE-2026-47879 | High | 7.7 | 2026-08-27 | Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 -… |
CVE-2026-81421 | High | 7.3 | 2026-08-27 | A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component raw_sentry_api. The… |
CVE-2026-47861 | Medium | 6.3 | 2026-08-27 | An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP da… |
CVE-2026-75340 | Critical | 9.1 | 2026-08-26 | The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forg… |
CVE-2026-75332 | Critical | 9.1 | 2026-08-26 | Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download(). |
CVE-2025-62341 | Low | 3.7 | 2026-08-26 | HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized r… |
CVE-2026-77573 | Low | 3.5 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component… |
CVE-2026-71172 | Medium | 4.3 | 2026-08-26 | Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access… |
CVE-2026-80350 | High | 7.1 | 2026-08-26 | OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped I… |
CVE-2026-80347 | High | 7.5 | 2026-08-26 | mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parse… |
CVE-2026-52776 | | 2026-08-26 | Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurity… | |
CVE-2026-45019 | High | 7.2 | 2026-08-25 | Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp… |
CVE-2026-79788 | High | 7.1 | 2026-08-25 | In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that i… |
CVE-2026-76193 | Critical | 10.0 | 2026-08-25 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of… |
CVE-2026-70548 | Low | 3.5 | 2026-08-25 | Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency. |
CVE-2026-79717 | Medium | 6.4 | 2026-08-25 | A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace mana… |