CWE-918 · Server-Side Request Forgery (SSRF) (page 5)
Page 5 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57348 | High | 7.2 | 2026-07-02 | Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions. |
CVE-2026-54430 | | 2026-07-02 | liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the… | |
CVE-2026-14336 | High | 8.2 | 2026-07-02 | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py… |
CVE-2026-55791 | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Serv… | |
CVE-2026-24242 | High | 7.8 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability… |
CVE-2026-13603 | | 2026-07-01 | The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The in… | |
CVE-2026-56399 | Medium | 5.0 | 2026-06-30 | Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to… |
CVE-2025-36324 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 s vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send u… |
CVE-2026-13773 | Medium | 6.0 | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_… |
CVE-2026-11714 | High | 8.5 | 2026-06-30 | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled. |
CVE-2026-11546 | High | 7.1 | 2026-06-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 featur… |
CVE-2026-10564 | High | 8.2 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py… |
CVE-2026-10546 | High | 7.1 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the URL component ( src/lfx/src/lfx/components/data_source/… |
CVE-2026-10129 | High | 8.5 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticat… |
CVE-2026-48285 | High | 8.6 | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypa… |
CVE-2026-13316 | Medium | 4.4 | 2026-06-30 | A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and http_proxy files. Attackers can perform an SSRF attack and st… |
CVE-2026-57947 | High | 8.5 | 2026-06-29 | Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register in… |
CVE-2026-56285 | High | 8.6 | 2026-06-29 | Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated at… |
CVE-2026-13751 | Medium | 4.1 | 2026-06-29 | Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !sourc… |
CVE-2026-13540 | Medium | 6.3 | 2026-06-29 | A security flaw has been discovered in GitBucket up to 4.46.1. This affects the function Git.cloneRepository.setURI of the file src/main/scala/gitbucket/core/s… |
CVE-2026-49869 | Critical | 10.0 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("… |
CVE-2026-54353 | High | 8.5 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS… |
CVE-2026-56663 | High | 8.5 | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.52, an authenticated us… |
CVE-2026-28385 | Medium | 5.0 | 2026-06-26 | In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users wit… |
CVE-2026-57627 | Medium | 4.9 | 2026-06-26 | Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions. |
CVE-2026-56026 | Medium | 6.4 | 2026-06-26 | Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions. |
CVE-2026-4339 | Medium | 6.5 | 2026-06-26 | Mattermost versions 10.11.x <= 10.11.18, 11.6.x <= 11.6.3, 11.5.x <= 11.5.6 fail to validate attachment URLs against internal or private IP ranges in the Matte… |
CVE-2026-57940 | | 2026-06-26 | HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The function get_feed() in system/admin/admin.php… | |
CVE-2026-2053 | High | 8.3 | 2026-06-26 | The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within t… |
CVE-2026-8661 | Medium | 4.8 | 2026-06-26 | Server-Side Request Forgery in the markdown_to_pdf action of Rapid7 InsightConnect Markdown Plugin on Linux in versions prior to 4.0.2 allows remote attackers… |
CVE-2026-13318 | Medium | 6.4 | 2026-06-26 | A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInst… |
CVE-2026-12992 | High | 7.4 | 2026-06-25 | A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VA… |
CVE-2026-12473 | High | 8.2 | 2026-06-25 | Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authenticatio… |
CVE-2026-56779 | Medium | 6.4 | 2026-06-25 | MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrar… |
CVE-2026-56771 | High | 8.5 | 2026-06-25 | NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows authenticated users to make arbitrary s… |
CVE-2026-56769 | High | 8.5 | 2026-06-25 | Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod… |
CVE-2026-55412 | High | 8.3 | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's… |
CVE-2026-54033 | High | 7.7 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible AP… |
CVE-2026-55455 | Critical | 9.1 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by th… |
CVE-2026-50189 | High | 7.2 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port… |
CVE-2026-49979 | Low | 2.7 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-c… |
CVE-2026-52805 | High | 8.7 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration function… |
CVE-2026-47267 | High | 8.3 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostnam… |
CVE-2026-47389 | High | 8.6 | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, when using Ruby versions older than 3.4, Priva… |
CVE-2026-46348 | | 2026-06-24 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP address ranges was l… | |
CVE-2026-53946 | Medium | 5.4 | 2026-06-24 | Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an out… |
CVE-2026-53945 | Medium | 4.0 | 2026-06-24 | Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding… |
CVE-2026-53944 | Medium | 5.8 | 2026-06-24 | Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external request, it is possible to bypass the IP filter that ensures the… |
CVE-2026-44016 | High | 8.2 | 2026-06-24 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions >= 2.82.0, < 2.91.0… |
CVE-2026-12986 | | 2026-06-24 | A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, 6.2024.x on All platforms that allows the attacker to leak… | |
CVE-2026-57303 | High | 7.1 | 2026-06-24 | Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the… |
CVE-2026-13150 | | 2026-06-24 | Server-Side Request Forgery (SSRF) (CWE-918) in the PDF generation endpoint GET /api/reports/{id}/pdf (backend/main.py) in ccyl13 Pentestify 1.0.0 and lower al… | |
CVE-2026-12100 | High | 7.2 | 2026-06-24 | The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes… |
CVE-2026-12095 | High | 7.2 | 2026-06-24 | The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2 via the 'api_url' parameter. This m… |
CVE-2026-11370 | Medium | 6.4 | 2026-06-24 | The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'new_link' parameter. Th… |
CVE-2026-54514 | Medium | 5.3 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4… |
CVE-2026-53931 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-import endpoint axiosRequestMake could be used as a generic HTTP… | |
CVE-2026-53930 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a caller-supplied URL that the migration wo… | |
CVE-2026-53927 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch endpoint (axiosRequestMake) accepted URLs whose path conta… | |
CVE-2026-47382 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied databa… | |
CVE-2026-46548 | Medium | 4.3 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering-agent SSRF protection was non-functional in the four notif… |
CVE-2026-53755 | High | 8.6 | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server applied its SSRF destination check to the crawl target URL… |
CVE-2026-53754 | High | 7.5 | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection (validate_webhook_url / validate_url_des… |
CVE-2026-54157 | Critical | 9.0 | 2026-06-23 | LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on a… |
CVE-2026-54018 | High | 7.7 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a val… |
CVE-2026-54008 | High | 8.5 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/open_webui/utils/oauth.py::_process_… |
CVE-2026-50221 | Medium | 5.4 | 2026-06-23 | In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Devi… |
CVE-2026-49860 | Medium | 5.2 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connection was opened, Deno checked the destination hostname agains… |
CVE-2026-49859 | Medium | 5.2 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, Deno checked the destination hostname against --deny-net ru… |
CVE-2026-56275 | High | 7.1 | 2026-06-23 | Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by provi… |
CVE-2026-56348 | Critical | 9.1 | 2026-06-22 | n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users t… |
CVE-2026-56266 | High | 8.6 | 2026-06-22 | Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, /crawl/stream, /md, and /llm endpoints that fetch arbitrary user-supp… |
CVE-2026-55599 | Medium | 5.8 | 2026-06-22 | phpseclib is a PHP secure communications library. From 0.1.1 until 1.0.30, 2.0.55, and 3.0.54, when an application validates an untrusted X.509 certificate wit… |
CVE-2026-54300 | Medium | 5.3 | 2026-06-22 | @astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro ima… |
CVE-2026-54299 | High | 7.5 | 2026-06-22 | Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over… |
CVE-2026-50168 | High | 8.2 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2… |
CVE-2026-46417 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.12, 21… |
CVE-2026-9006 | High | 7.4 | 2026-06-22 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to… |
CVE-2026-12813 | Medium | 6.3 | 2026-06-21 | A vulnerability was detected in activepieces up to 0.83.0. This vulnerability affects the function handleUrlFile in the library packages/server/engine/src/lib/… |
CVE-2026-12798 | Medium | 6.3 | 2026-06-21 | A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/prox… |
CVE-2026-12774 | Medium | 6.3 | 2026-06-21 | A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function _execute_with_mcp_client of the file… |
CVE-2026-56342 | Medium | 6.8 | 2026-06-20 | AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbit… |
CVE-2026-56227 | Medium | 5.4 | 2026-06-20 | Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization… |
CVE-2026-49345 | | 2026-06-19 | Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery (SSRF) vu… | |
CVE-2026-12726 | Medium | 6.3 | 2026-06-19 | A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks, the controller stores the pull_request.statuses_url value… |
CVE-2026-49359 | Medium | 6.5 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `pontedilana/php-weasyprint` fetches the content of… |
CVE-2026-4328 | Medium | 6.4 | 2026-06-19 | The Advanced Import plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.6. This is due to the plugin us… |
CVE-2026-11989 | Medium | 6.5 | 2026-06-19 | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Server-Side Request Forgery i… |
CVE-2026-54017 | High | 7.7 | 2026-06-18 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy in `backen… |
CVE-2025-58175 | Medium | 6.5 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESO… |
CVE-2026-11395 | High | 7.2 | 2026-06-18 | The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pull_the_trigger. This… |
CVE-2026-48764 | High | 8.2 | 2026-06-18 | TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented by resolving a hostname once and checking whether the resolved I… |
CVE-2026-12566 | Low | 3.1 | 2026-06-17 | The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An… |
CVE-2026-48818 | High | 7.5 | 2026-06-17 | Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker… |
CVE-2026-48782 | Medium | 6.8 | 2026-06-17 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, t… |
CVE-2026-53859 | Medium | 6.5 | 2026-06-16 | OpenClaw before 2026.5.26 contains a hostname validation vulnerability allowing attackers to bypass blocklist comparisons using trailing-dot notation in model… |
CVE-2026-47684 | High | 7.7 | 2026-06-16 | Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex… |
CVE-2025-60175 | Medium | 4.4 | 2026-06-15 | Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions. |
CVE-2026-50888 | High | 8.1 | 2026-06-15 | An authenticated Server-Side Request Forgery (SSRF) in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan in… |
CVE-2026-50887 | Critical | 9.1 | 2026-06-15 | A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via sup… |