CWE-918 · Server-Side Request Forgery (SSRF) (page 6)
Page 6 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-50887 | Critical | 9.1 | 2026-06-15 | A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via sup… |
CVE-2026-12210 | Medium | 6.3 | 2026-06-15 | A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. P… |
CVE-2026-53827 | Medium | 6.5 | 2026-06-12 | OpenClaw before 2026.5.2 contains a credential exposure vulnerability in message.action forwarding that allows model-controlled metadata to forward action payl… |
CVE-2026-47268 | Medium | 6.4 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.10, an authenticated… |
CVE-2026-46717 | High | 7.7 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard s… |
CVE-2026-53607 | Low | 3.7 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, when `prettyUrls: true` is enabled on `@apostrophecm… |
CVE-2026-45012 | High | 7.6 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SS… |
CVE-2026-50552 | Medium | 6.3 | 2026-06-12 | Koel is a free, open-source music streaming solution. Prior to version 9.7.1, Koel contains a Server-Side Request Forgery (SSRF) vulnerability in the radio sta… |
CVE-2026-47260 | High | 7.7 | 2026-06-12 | Koel is a free, open-source music streaming solution. Prior to version 9.3.5, Koel validates the podcast feed URL via the SafeUrl rule (DNS resolution + public… |
CVE-2026-53812 | High | 7.7 | 2026-06-11 | OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network nav… |
CVE-2026-53782 | High | 7.4 | 2026-06-11 | Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch t… |
CVE-2026-47170 | High | 7.7 | 2026-06-11 | Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users c… |
CVE-2026-47157 | Medium | 6.5 | 2026-06-11 | aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build re… |
CVE-2026-46698 | Medium | 5.3 | 2026-06-11 | Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.9, Fediverse Embeds registered the unauthenticated AJAX action wp_ajax_nopriv_… |
CVE-2026-46697 | High | 7.5 | 2026-06-11 | Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST route ftf/media-proxy (… |
CVE-2026-44492 | High | 8.6 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROX… |
CVE-2026-3341 | Medium | 5.4 | 2026-06-11 | IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send una… |
CVE-2026-48998 | Medium | 5.3 | 2026-06-11 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 contain improper Host header validation when parsing raw HTTP r… |
CVE-2026-9204 | Medium | 5.3 | 2026-06-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certai… |
CVE-2026-40999 | High | 8.6 | 2026-06-11 | When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSen… |
CVE-2026-50131 | High | 8.6 | 2026-06-10 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg… |
CVE-2026-50127 | Medium | 5.9 | 2026-06-10 | Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_RESTRICT_PRIVATE did not properly account for some transiti… |
CVE-2026-46683 | | 2026-06-10 | Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.7.0, there is a SSRF and local file read v… | |
CVE-2026-20252 | High | 7.6 | 2026-06-10 | In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1… |
CVE-2026-48858 | Medium | 6.5 | 2026-06-10 | Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP… |
CVE-2026-46497 | | 2026-06-10 | Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnerable to SSRF via sitemap-derived URLs. T… | |
CVE-2026-45561 | Medium | 6.5 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the /smon/agent/{version,uptime,status,ch… |
CVE-2026-47938 | Critical | 10.0 | 2026-06-09 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in priv… |
CVE-2026-45504 | High | 8.8 | 2026-06-09 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-45503 | High | 8.1 | 2026-06-09 | Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network. |
CVE-2026-45502 | Medium | 5.0 | 2026-06-09 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network. |
CVE-2026-45501 | Medium | 6.5 | 2026-06-09 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network. |
CVE-2026-41854 | Medium | 4.2 | 2026-06-09 | Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a serve… |
CVE-2026-11469 | Medium | 4.7 | 2026-06-08 | A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/P… |
CVE-2026-11437 | High | 7.3 | 2026-06-06 | A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installatio… |
CVE-2026-11424 | | 2026-06-05 | A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Server and Altium 365. An authenticated us… | |
CVE-2026-46393 | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26… | |
CVE-2026-46391 | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple fu… | |
CVE-2026-11346 | | 2026-06-05 | A Server-Side Request Forgery (SSRF) vulnerability in the custom process creation feature of linqi allows an authenticated attacker to probe internal network c… | |
CVE-2026-10586 | High | 7.2 | 2026-06-05 | The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions… |
CVE-2026-43986 | Critical | 9.9 | 2026-06-04 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public `/image/<hash>` route that resolves att… |
CVE-2026-10771 | High | 7.3 | 2026-06-03 | A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/ut… |
CVE-2026-26379 | Medium | 6.5 | 2026-06-03 | Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. This allows authenticated attacke… |
CVE-2026-20230 | High | 8.6 | 2026-06-03 | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could… |
CVE-2026-10690 | Medium | 6.3 | 2026-06-03 | A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of the file src/tools/filesystem.ts of the… |
CVE-2026-10662 | Medium | 6.3 | 2026-06-02 | A vulnerability was found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The affected element is the function requests.get of the file… |
CVE-2026-49120 | High | 8.5 | 2026-06-02 | Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized i… |
CVE-2026-10583 | Medium | 4.7 | 2026-06-02 | A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. Affected by this issue is the function Import of the file internal/http/tts… |
CVE-2026-10581 | Medium | 6.3 | 2026-06-02 | A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64_decode of the file /plus/download.php?open=1. This manipulation… |
CVE-2026-49139 | | 2026-06-01 | Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfi… | |
CVE-2026-49138 | Medium | 5.0 | 2026-06-01 | Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows remote attackers to reach internal or pri… |
CVE-2026-10287 | High | 7.3 | 2026-06-01 | A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function get_headers of the file /index.php. This m… |
CVE-2026-10280 | High | 7.3 | 2026-06-01 | A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts o… |
CVE-2026-10276 | Medium | 6.3 | 2026-06-01 | A vulnerability has been found in hekmon8 Jenkins-server-mcp 0.1.0. This vulnerability affects the function jobPath of the file src/index.ts of the component g… |
CVE-2026-10274 | Medium | 6.3 | 2026-06-01 | A vulnerability was determined in indrasishbanerjee aem-mcp-server up to b5f833aef9b5dfd17a5991b3b18a8a11edbdc583. This impacts the function getAssetMetadata o… |
CVE-2026-49328 | Medium | 5.3 | 2026-06-01 | Server-Side Request Forgery (SSRF) in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet before 2.0.2-incubating allows attackers to caus… |
CVE-2026-10241 | Medium | 6.3 | 2026-06-01 | A security flaw has been discovered in jeecgboot The server processes these URLs up to 3.9.1. This affects the function FileDownloadUtils.download2DiskFromNet… |
CVE-2026-10240 | Medium | 6.3 | 2026-06-01 | A vulnerability was identified in JeecgBoot up to 3.9.2. The impacted element is an unknown function of the file /airag/airagModel/test. The manipulation of th… |
CVE-2026-10239 | Medium | 6.3 | 2026-06-01 | A vulnerability was determined in JeecgBoot up to 3.9.2. The affected element is the function WordUtil.addImage of the file /airag/word/edit. Executing a manip… |
CVE-2026-10177 | Medium | 6.3 | 2026-05-31 | A security vulnerability has been detected in Aider-AI Aider 0.86.3. This affects the function requests.get of the file api_docs.py of the component AWS EC2 Me… |
CVE-2026-48555 | High | 7.4 | 2026-05-29 | Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery vulnerability that allows remote attackers to cause the server to is… |
CVE-2026-44285 | High | 7.7 | 2026-05-29 | FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, a Server-Side Request Forgery (SSRF) vulnerability allows an authenticated attacker to bypass… |
CVE-2026-49372 | High | 7.5 | 2026-05-29 | In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible |
CVE-2026-46372 | High | 8.5 | 2026-05-29 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… |
CVE-2026-44652 | | 2026-05-29 | SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-… | |
CVE-2026-45660 | Medium | 5.4 | 2026-05-29 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.22 and 6.18.1, the Glide image proxy's URL validation could be bypassed us… |
CVE-2026-10107 | High | 7.7 | 2026-05-29 | MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated attackers to request arbitrary URLs by… |
CVE-2026-10068 | High | 7.3 | 2026-05-29 | A flaw has been found in Shibby Tomato 1.28. The affected element is the function send of the file usr/sbin/miniupnpd of the component SUBSCRIBE Call Handler… |
CVE-2026-45609 | High | 7.2 | 2026-05-29 | mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement… |
CVE-2026-45619 | Medium | 6.5 | 2026-05-29 | WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolved… |
CVE-2026-9557 | Medium | 6.4 | 2026-05-29 | A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated u… |
CVE-2026-42965 | High | 7.7 | 2026-05-29 | A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully… |
CVE-2026-10052 | Medium | 4.1 | 2026-05-29 | A flaw was found in the Quay config-tool's LDAP and SMTP validation functions. An attacker with config editor access can exploit these functions, which make ou… |
CVE-2026-45366 | Medium | 4.7 | 2026-05-28 | typescript-utcp is a typescript implementation of UTCP. Prior to 1.1.2, the @utcp/http package is vulnerable to a blind Server-Side Request Forgery (SSRF) caus… |
CVE-2026-49093 | Medium | 6.3 | 2026-05-28 | Server-Side Request Forgery (CWE-918) in Kibana can allow an authenticated user with connector management privileges to bypass the operator-configured connecto… |
CVE-2026-42398 | High | 7.7 | 2026-05-28 | Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-configured connection al… |
CVE-2026-49129 | Medium | 5.8 | 2026-05-28 | Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerability in CurlInputPlugin where CURLOPT_FOLLOWLOCATION is set wi… |
CVE-2026-46526 | Medium | 5.0 | 2026-05-28 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.10, the URL checking logic in local-deep-research has a logi… |
CVE-2026-43979 | Medium | 5.0 | 2026-05-28 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0, PDFService._markdown_to_html() constructs an HTML documen… |
CVE-2026-46561 | Medium | 5.0 | 2026-05-28 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTION-based private IP check was not applied to HTTP… |
CVE-2026-45373 | High | 7.4 | 2026-05-28 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses… |
CVE-2026-45310 | High | 7.4 | 2026-05-28 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restrict… |
CVE-2026-44797 | High | 8.5 | 2026-05-28 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set coul… |
CVE-2026-48522 | Medium | 4.2 | 2026-05-28 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen() which uses Python… |
CVE-2026-9813 | Critical | 9.9 | 2026-05-28 | FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py… |
CVE-2026-5737 | Medium | 6.5 | 2026-05-28 | The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a publ… |
CVE-2026-48153 | High | 8.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, fetchToken in the OAuth2 SDK makes a POST to a builder-supplied URL with plain node-fetch, skipp… |
CVE-2026-48148 | | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.35.3, the VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no vali… | |
CVE-2026-48146 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the OAuth2 token fetch function in packages/server/src/sdk/workspace/oauth2/utils.ts uses raw fe… |
CVE-2026-48128 | | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the executeQuery automation step in Budibase accepts a queryId from automation step inputs and p… | |
CVE-2026-45715 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, the REST datasource integration (packages/server/src/integrations/rest.ts) follows HTTP redirect… |
CVE-2026-45548 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetch(fi… |
CVE-2026-45061 | High | 7.7 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.35.10, the Plugin URL upload endpoint (POST /api/plugin) validates the submitted URL with a single sub… |
CVE-2026-48918 | Medium | 6.6 | 2026-05-27 | Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. |
CVE-2026-48916 | Medium | 6.6 | 2026-05-27 | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals. |
CVE-2026-44971 | High | 8.2 | 2026-05-27 | GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled rep… |
CVE-2026-42184 | High | 8.8 | 2026-05-27 | Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a flaw in Tauri's is_local_url() function causes it to incorrec… |
CVE-2026-9312 | High | 8.2 | 2026-05-27 | A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to send crafted requests… |
CVE-2026-8606 | Medium | 5.9 | 2026-05-27 | A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP reques… |
CVE-2026-45298 | High | 8.6 | 2026-05-26 | Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy (the documented quickstart, no DOZZLE_AUTH_PROVIDER set), PO… |