CWE-918 · Server-Side Request Forgery (SSRF) (page 8)
Page 8 of 32 — CVEs classified under CWE-918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-42261 | High | 7.1 | 2026-05-08 | PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.4, apps/web/src/routes/skills.ts expose… |
CVE-2026-8034 | Critical | 9.8 | 2026-05-07 | A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal s… |
CVE-2026-41105 | High | 8.1 | 2026-05-07 | Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network. |
CVE-2026-42449 | High | 8.5 | 2026-05-07 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In versions 2.47.4 through 2.47.13, the SDK… |
CVE-2026-41905 | High | 7.7 | 2026-05-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, Helper::sanitizeRemoteUrl() in app/Misc/Helper.php… |
CVE-2026-8081 | Medium | 6.3 | 2026-05-07 | A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/mana… |
CVE-2026-41689 | Medium | 6.0 | 2026-05-07 | Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notification feature reuses an administrator-co… |
CVE-2026-41688 | High | 7.7 | 2026-05-07 | Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs vi… |
CVE-2026-41687 | Medium | 4.3 | 2026-05-07 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.8.1, the SSRF protection in endpoints/subscription/add.php (line 42)… |
CVE-2026-41654 | High | 8.1 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission (default on hosted Weblate SaaS and for an… |
CVE-2026-41644 | High | 7.1 | 2026-05-07 | monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow in… |
CVE-2026-41413 | Medium | 5.0 | 2026-05-07 | Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created w… |
CVE-2026-42194 | Medium | 6.8 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP a… |
CVE-2026-44117 | Medium | 5.8 | 2026-05-06 | OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips URL validation. Attackers can bypass SSR… |
CVE-2026-44116 | High | 8.6 | 2026-05-06 | OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo UR… |
CVE-2026-43576 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.5 contains a server-side request forgery vulnerability in the CDP /json/version WebSocket endpoint that allows attackers to pivot to unt… |
CVE-2026-20035 | High | 7.2 | 2026-05-06 | A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected d… |
CVE-2026-39383 | High | 7.2 | 2026-05-05 | Gotenberg is an API-based document conversion tool. In version 8.29.1, an unauthenticated attacker with network access can force the server to make outbound HT… |
CVE-2026-35527 | Medium | 5.0 | 2026-05-05 | Incus is an open source container and virtual machine manager. In versions prior to 7.0.0, the image import flow issues an outbound HEAD request to a user-supp… |
CVE-2026-40280 | High | 7.5 | 2026-05-05 | Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-dow… |
CVE-2026-34084 | Critical | 9.8 | 2026-05-05 | PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through… |
CVE-2026-33975 | | 2026-05-05 | Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be… | |
CVE-2026-7412 | High | 8.6 | 2026-05-05 | In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requ… |
CVE-2026-43573 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypa… |
CVE-2026-43527 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.14 contains a server-side request forgery vulnerability in browser SSRF policy that allows private-network navigation by default. Attack… |
CVE-2026-43526 | High | 8.2 | 2026-05-05 | OpenClaw before 2026.4.12 contains a server-side request forgery vulnerability in QQBot reply media URL handling that allows attackers to fetch arbitrary conte… |
CVE-2026-42439 | High | 8.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can… |
CVE-2026-2948 | Medium | 6.4 | 2026-05-05 | The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and incl… |
CVE-2026-42140 | Medium | 4.4 | 2026-05-04 | PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML Macro is vulnerable to Server-Side Reque… |
CVE-2026-7729 | Medium | 6.3 | 2026-05-04 | A security flaw has been discovered in pixelsock directus-mcp 1.0.0. This issue affects the function validateUrl of the file index.ts of the component MCP Inte… |
CVE-2026-6229 | High | 7.2 | 2026-05-02 | The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insuffi… |
CVE-2026-7605 | Medium | 6.3 | 2026-05-02 | A security flaw has been discovered in JeecgBoot up to 3.9.1. This vulnerability affects the function CommonController.uploadImgByHttp/HttpFileToMultipartFileU… |
CVE-2026-7049 | High | 7.2 | 2026-05-02 | The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2026-6812 | Medium | 4.4 | 2026-05-02 | The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This make… |
CVE-2026-7604 | Medium | 6.3 | 2026-05-02 | A vulnerability was identified in JeecgBoot up to 3.9.1. This affects the function OpenApiController.add/OpenApiController.call of the file OpenApiController.j… |
CVE-2026-7603 | Medium | 6.3 | 2026-05-02 | A vulnerability was determined in JeecgBoot up to 3.9.1. Affected by this issue is the function checkPathTraversalBatch of the file FileDownloadUtils.jav of th… |
CVE-2026-42404 | Medium | 6.5 | 2026-05-01 | Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application exp… |
CVE-2026-3340 | Medium | 6.5 | 2026-04-30 | IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send una… |
CVE-2026-36764 | Medium | 5.0 | 2026-04-30 | A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers to scan internal r… |
CVE-2026-36757 | Medium | 4.3 | 2026-04-30 | A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resource… |
CVE-2026-36759 | Medium | 6.5 | 2026-04-30 | A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources… |
CVE-2026-36758 | Medium | 4.3 | 2026-04-30 | A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via… |
CVE-2026-36756 | Medium | 5.4 | 2026-04-30 | A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via… |
CVE-2026-7417 | High | 7.3 | 2026-04-29 | A vulnerability was found in Algovate xhs-mcp 0.8.11. This affects the function xhs_publish_content of the file src/server/mcp.server.ts of the component MCP I… |
CVE-2026-42641 | Medium | 5.4 | 2026-04-29 | Server-Side Request Forgery (SSRF) vulnerability in ILLID Share This Image share-this-image allows Server Side Request Forgery.This issue affects Share This Im… |
CVE-2026-23773 | Medium | 4.3 | 2026-04-29 | Dell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote… |
CVE-2026-7305 | Medium | 6.3 | 2026-04-28 | A weakness has been identified in Xuxueli xxl-job up to 3.3.2. The affected element is the function triggerJob of the file xxl-job-admin/src/main/java/com/xxl/… |
CVE-2026-7291 | Medium | 6.3 | 2026-04-28 | A weakness has been identified in o2oa up to 10.0. This affects the function FileAction of the file FileAction.java of the component URL Fetching. Executing a… |
CVE-2026-42430 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in Playwright redirect handling that allows attackers to bypass strict SSRF check… |
CVE-2026-41914 | High | 8.5 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit… |
CVE-2026-41912 | High | 7.6 | 2026-04-28 | OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF che… |
CVE-2026-24231 | Medium | 6.3 | 2026-04-28 | NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by… |
CVE-2026-7223 | High | 7.3 | 2026-04-28 | A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/s… |
CVE-2026-7221 | High | 7.3 | 2026-04-28 | A vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0. Affected is the function openUrl of the file mcp/src/interactive-server.ts of the com… |
CVE-2026-7178 | High | 7.3 | 2026-04-27 | A weakness has been identified in ChatGPTNextWeb NextChat up to 2.16.1. This affects the function storeUrl of the file app/api/artifacts/route.ts of the compon… |
CVE-2026-7177 | High | 7.3 | 2026-04-27 | A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1. Affected by this issue is the function proxyHandler of the file app/api/[provider]… |
CVE-2026-7158 | High | 7.3 | 2026-04-27 | A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function _validat… |
CVE-2026-7150 | Medium | 6.3 | 2026-04-27 | A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generate_favicon_from_url of t… |
CVE-2026-7147 | High | 7.3 | 2026-04-27 | A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js o… |
CVE-2026-7146 | High | 7.3 | 2026-04-27 | A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability i… |
CVE-2026-7094 | High | 7.3 | 2026-04-27 | A vulnerability was determined in ShadowCloneLabs GlutamateMCPServers up to e2de73280b01e5d943593dd1aa2c01c5b9112f78. Affected by this issue is some unknown fu… |
CVE-2026-7084 | Medium | 6.3 | 2026-04-27 | A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of… |
CVE-2026-7065 | High | 7.3 | 2026-04-27 | A vulnerability has been found in BidingCC BuildingAI up to 26.0.1. Impacted is the function uploadRemoteFile of the file packages/core/src/modules/upload/serv… |
CVE-2026-7025 | High | 7.3 | 2026-04-26 | A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the com… |
CVE-2026-6983 | Medium | 4.7 | 2026-04-25 | A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/downloa… |
CVE-2026-6981 | Medium | 6.3 | 2026-04-25 | A vulnerability was found in IhateCreatingUserNames2 AiraHub2 up to 3e4b77fd7d48ed811ffe5b8d222068c17c76495e. Affected is the function connect_stream_endpoint/… |
CVE-2026-6979 | Medium | 6.3 | 2026-04-25 | A flaw has been found in devlikeapro WAHA up to 2026.3.4. This affects an unknown function of the file src/api/media.controller.ts of the component API Request… |
CVE-2026-41488 | Low | 3.1 | 2026-04-24 | LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_fr… |
CVE-2026-41481 | Medium | 6.5 | 2026-04-24 | LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTMLHeaderTextSplitter.split_text_from_url… |
CVE-2026-42043 | High | 7.2 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request… |
CVE-2026-42038 | Medium | 6.8 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete… |
CVE-2026-41321 | Low | 2.2 | 2026-04-24 | @astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cl… |
CVE-2026-41323 | High | 8.1 | 2026-04-24 | Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.18.0-rc1, 1.17.2-rc1, and 1.16.4, Kyverno's apiCall featur… |
CVE-2026-31955 | Medium | 4.9 | 2026-04-24 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. An authenticated Server-Side Request… |
CVE-2026-41361 | High | 7.1 | 2026-04-23 | OpenClaw before 2026.3.28 contains an SSRF guard bypass vulnerability that fails to block four IPv6 special-use ranges. Attackers can exploit this by crafting… |
CVE-2026-35431 | Critical | 10.0 | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-32210 | Critical | 9.3 | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-26150 | High | 8.6 | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-41272 | High | 7.1 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the core security wrappers (secureAxiosRequest and sec… |
CVE-2026-41271 | High | 8.3 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) vulnerability exi… |
CVE-2026-41270 | High | 7.1 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass… |
CVE-2026-41461 | High | 8.5 | 2026-04-23 | SocialEngine versions 7.8.0 and prior contain a blind server-side request forgery vulnerability in the /core/link/preview endpoint where user-supplied input pa… |
CVE-2026-41455 | High | 8.5 | 2026-04-22 | WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string withou… |
CVE-2026-41177 | Medium | 5.5 | 2026-04-22 | Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blin… |
CVE-2026-41172 | | 2026-04-22 | Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asse… | |
CVE-2026-41171 | | 2026-04-22 | Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery (SSRF) vul… | |
CVE-2026-41170 | | 2026-04-22 | Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.PostRestoreJob` endpoi… | |
CVE-2026-35548 | High | 8.5 | 2026-04-22 | An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored d… |
CVE-2026-41130 | | 2026-04-22 | Craft CMS is a content management system (CMS). In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the `resource-js` endpoint in C… | |
CVE-2026-41129 | | 2026-04-22 | Craft CMS is a content management system (CMS). Versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14 are vulnerable to Server-Side Reque… | |
CVE-2026-5921 | High | 8.9 | 2026-04-21 | A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an attacker to extract sensitive environment variabl… |
CVE-2026-41060 | High | 7.7 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shor… |
CVE-2026-41055 | High | 8.6 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation… |
CVE-2026-6744 | Medium | 6.3 | 2026-04-21 | A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulation results in server… |
CVE-2026-40566 | Medium | 4.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a Server-Side Request Forgery (SSRF) vulnerability in the IMAP/SMT… |
CVE-2026-41302 | High | 7.6 | 2026-04-21 | OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows remote attackers to… |
CVE-2026-41297 | High | 7.6 | 2026-04-21 | OpenClaw before 2026.3.31 contains a server-side request forgery vulnerability in the marketplace plugin download functionality that allows attackers to access… |
CVE-2026-35587 | High | 8.8 | 2026-04-21 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, a Server-Side Request Forgery (SSRF) vulnerability exists in the Glanc… |
CVE-2026-33626 | High | 7.5 | 2026-04-20 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnera… |
CVE-2026-34428 | High | 7.7 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is pa… |