CWE-918 · Server-Side Request Forgery (SSRF) (page 6)
Page 6 of 38 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-70551 | High | 8.5 | 2026-08-25 | A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL. |
CVE-2026-55537 | High | 7.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.g… |
CVE-2026-55535 | Medium | 6.8 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind th… |
CVE-2026-55526 | High | 8.5 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_pag… |
CVE-2026-55525 | High | 7.5 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses h… |
CVE-2026-79671 | Medium | 5.5 | 2026-08-25 | Ech0 before 4.4.3 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), which only validates li… |
CVE-2026-79659 | High | 7.7 | 2026-08-25 | Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe… |
CVE-2026-55976 | Critical | 9.1 | 2026-08-25 | Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privil… |
CVE-2026-78682 | High | 7.5 | 2026-08-25 | NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/d… |
CVE-2026-34964 | Medium | 5.8 | 2026-08-25 | Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for… |
CVE-2026-77310 | Medium | 5.3 | 2026-08-24 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Prior to versions 2.18.9, 2.21.5, 2.22.1, 3… |
CVE-2026-76838 | High | 8.5 | 2026-08-24 | Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRul… |
CVE-2026-71366 | High | 7.7 | 2026-08-24 | A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notificat… |
CVE-2026-78385 | | 2026-08-24 | RansomLook contains insufficient resource validation in the analysis PDF generation functionality. Analysis documents are converted from Markdown to HTML and p… | |
CVE-2026-78277 | Medium | 4.9 | 2026-08-24 | Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions. |
CVE-2026-78269 | Medium | 6.4 | 2026-08-24 | Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions. |
CVE-2026-10582 | High | 7.4 | 2026-08-24 | Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPUR… |
CVE-2026-75975 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an… |
CVE-2026-75899 | High | 7.5 | 2026-08-24 | fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authori… |
CVE-2026-78205 | Medium | 5.8 | 2026-08-24 | BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP addresses but fails to reject… |
CVE-2026-78061 | Medium | 6.3 | 2026-08-23 | A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the compon… |
CVE-2026-63311 | Medium | 5.3 | 2026-08-22 | NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/path… |
CVE-2026-78003 | Critical | 9.8 | 2026-08-22 | The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. Th… |
CVE-2026-47735 | | 2026-08-21 | Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator (`internal/api/query.go:ValidateSQLRequest`)… | |
CVE-2026-53509 | Medium | 5.7 | 2026-08-21 | CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_qu… |
CVE-2026-54457 | High | 7.7 | 2026-08-21 | TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the… |
CVE-2026-50288 | | 2026-08-21 | SpecifyJS is a declarative TypeScript user interface framework. Prior to version 0.2.136, when `new URL()` throws a parse error, the `assertSecureUrl` function… | |
CVE-2026-63004 | Medium | 5.5 | 2026-08-21 | Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled par… |
CVE-2026-69502 | Critical | 10.0 | 2026-08-21 | Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-22681 | High | 8.5 | 2026-08-21 | OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network servi… |
CVE-2026-77775 | High | 8.6 | 2026-08-21 | Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve_openai_upstream_base in headroom/proxy… |
CVE-2026-13176 | Low | 2.7 | 2026-08-21 | The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contr… |
CVE-2026-61422 | Medium | 4.3 | 2026-08-21 | Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudS… |
CVE-2026-59085 | Critical | 9.1 | 2026-08-21 | Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache C… |
CVE-2026-50112 | High | 8.8 | 2026-08-21 | SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal… |
CVE-2026-77648 | Low | 2.2 | 2026-08-20 | In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs fro… |
CVE-2026-77646 | | 2026-08-20 | A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the d… | |
CVE-2026-72860 | High | 8.5 | 2026-08-20 | The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination wit… |
CVE-2026-72848 | High | 8.6 | 2026-08-20 | SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries… |
CVE-2026-72846 | Medium | 6.4 | 2026-08-20 | Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleCha… |
CVE-2026-69855 | High | 7.7 | 2026-08-20 | Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network. |
CVE-2026-69851 | Critical | 9.9 | 2026-08-20 | Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69543 | High | 8.5 | 2026-08-20 | Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network. |
CVE-2026-66800 | High | 8.6 | 2026-08-20 | Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network. |
CVE-2026-65801 | Critical | 10.0 | 2026-08-20 | Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-54508 | | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNa… | |
CVE-2026-71428 | Critical | 9.3 | 2026-08-20 | The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many mo… |
CVE-2026-65842 | High | 8.2 | 2026-08-20 | Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML throug… |
CVE-2026-61704 | High | 7.5 | 2026-08-20 | Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the ori… |
CVE-2026-63044 | Medium | 5.4 | 2026-08-20 | Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Manager server to make… |
CVE-2026-64968 | | 2026-08-20 | ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HT… | |
CVE-2026-77085 | Medium | 6.5 | 2026-08-20 | n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL us… |
CVE-2026-77069 | Medium | 4.3 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 d… |
CVE-2026-77067 | Medium | 5.0 | 2026-08-20 | The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no v… |
CVE-2026-77066 | Medium | 5.0 | 2026-08-20 | The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no… |
CVE-2026-76795 | High | 7.3 | 2026-08-20 | A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipul… |
CVE-2026-76402 | High | 8.2 | 2026-08-19 | In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could conf… |
CVE-2026-76389 | High | 8.8 | 2026-08-19 | In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the get_talos_enrichment capability could send a… |
CVE-2026-76361 | Low | 2.7 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../check_connectivity endpoint to make Splu… |
CVE-2026-76351 | High | 8.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does no… |
CVE-2026-76347 | Medium | 5.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does no… |
CVE-2026-54494 | | 2026-08-19 | Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost() uses filter_var() with FILTER_FLAG_NO_PRIV_RANGE and… | |
CVE-2026-54493 | High | 7.7 | 2026-08-19 | Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.vi… |
CVE-2026-54492 | Medium | 4.3 | 2026-08-19 | Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's p… |
CVE-2026-54491 | High | 7.1 | 2026-08-19 | Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPub… |
CVE-2026-53549 | High | 7.7 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endp… |
CVE-2026-68558 | High | 8.5 | 2026-08-19 | Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the… |
CVE-2026-66794 | Critical | 9.3 | 2026-08-19 | A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can a… |
CVE-2026-62680 | High | 7.1 | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local exte… |
CVE-2026-75583 | Low | 3.5 | 2026-08-19 | keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery (SSRF) guard bypass vulnerability that allows authenticated attacke… |
CVE-2026-20314 | Medium | 5.0 | 2026-08-19 | A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticat… |
CVE-2026-62668 | | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController… | |
CVE-2026-45741 | High | 7.5 | 2026-08-19 | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP function in pkg/gotenberg/outbound.go does not reject the 2002… |
CVE-2026-76239 | Medium | 6.3 | 2026-08-19 | Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal… |
CVE-2026-76225 | High | 7.7 | 2026-08-19 | ArcadeDB before 26.8.1 contains a server-side request forgery vulnerability in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. A… |
CVE-2026-54794 | High | 7.2 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote acces… |
CVE-2026-76164 | | 2026-08-19 | AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality. A low-privileged authenticated user with acc… | |
CVE-2026-17565 | High | 7.2 | 2026-08-19 | The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HT… |
CVE-2026-71303 | High | 7.7 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_acme_url enforced ACME_DIRECTORY_HOST_ALLOWLIST when an authority was created, but PUT /api/1… |
CVE-2026-70666 | High | 7.4 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acme_url through PUT /api/1/authorities/ without revalidation and… |
CVE-2026-65985 | | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/i… | |
CVE-2026-47719 | High | 8.2 | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in s… |
CVE-2026-70667 | Medium | 6.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the l… |
CVE-2026-55166 | Critical | 9.9 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destina… |
CVE-2026-55162 | Medium | 6.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Distribution Point and OCSP responder URLs from uploaded cert… |
CVE-2026-68927 | Low | 3.0 | 2026-08-18 | MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py v… |
CVE-2026-63643 | | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an at… | |
CVE-2026-63642 | | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTI… | |
CVE-2026-50143 | High | 8.1 | 2026-08-18 | The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Pr… |
CVE-2026-75856 | High | 8.6 | 2026-08-18 | CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attack… |
CVE-2026-71365 | High | 7.7 | 2026-08-18 | A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extr… |
CVE-2026-45123 | Medium | 4.3 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side… |
CVE-2026-12564 | Critical | 9.6 | 2026-08-18 | A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the c… |
CVE-2026-75898 | High | 8.5 | 2026-08-18 | RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component… |
CVE-2026-32553 | High | 7.2 | 2026-08-18 | Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions. |
CVE-2026-32473 | High | 7.2 | 2026-08-18 | Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions. |
CVE-2026-32467 | Medium | 6.0 | 2026-08-18 | Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions. |
CVE-2026-75844 | High | 7.1 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and ch… |
CVE-2026-74905 | High | 7.1 | 2026-08-18 | SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to e… |
CVE-2026-34884 | Critical | 9.8 | 2026-08-18 | SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0… |