CWE-918— Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog
4,127 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-918page 29 of 83
- CVE-2022-24789HIGHCVSS 7.6EG 7.62022-03-28
C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery (SSRF) by causing the server to make arbitrary GET requests to other servers in…
- CVE-2021-31950HIGHCVSS 7.6EG 7.62021-06-08
Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2020-24898HIGHCVSS 7.6EG 7.62020-08-29
The Table Filter and Charts for Confluence Server app before 5.3.26 (for Atlassian Confluence) allows SSRF via the "Table from CSV" macro (URL parameter).
- CVE-2024-6587HIGHCVSS 7.5EG 7.62024-09-13
A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the `api_base` parameter when making requests to `POST /chat/completions`, causing the application to …
- CVE-2022-45362HIGHCVSS 7.2EG 7.62023-12-07
Server-Side Request Forgery (SSRF) vulnerability in Paytm Paytm Payment Gateway.This issue affects Paytm Payment Gateway: from n/a through 2.7.0.
- CVE-2026-18378HIGHCVSS 6.8EG 7.62026-07-30
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-g…
- CVE-2022-0425HIGHCVSS 5.4EG 7.62022-04-01
A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.
- CVE-2026-111418HIGHCVSS 7.5EG 7.52026-10-29
A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing …
- CVE-2026-118659HIGHCVSS 7.5EG 7.52026-10-28
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's ServerRendererServer accepts unauthenticated HTTP/2 requests and resolves attacker-con…
- CVE-2026-118679HIGHCVSS 7.5EG 7.52026-10-28
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing …
- CVE-2026-113728HIGHCVSS 7.5EG 7.52026-10-20
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which pe…
- CVE-2026-88206HIGHCVSS 7.5EG 7.52026-10-13
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-70202HIGHCVSS 7.5EG 7.52026-10-13
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-70251HIGHCVSS 7.5EG 7.52026-10-13
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85963HIGHCVSS 7.5EG 7.52026-10-12
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to interna…
- CVE-2026-70357HIGHCVSS 7.5EG 7.52026-10-06
Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves the hostname when connecting. An attacker who can start a migration and control th…
- CVE-2026-104636HIGHCVSS 7.5EG 7.52026-10-06
Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations followed HTTP redirects without revalidating the destination. A repository admin…
- CVE-2026-95265HIGHCVSS 7.5EG 7.52026-10-05
Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation does not block loopback or link-local addresses, allowing an attacker to make the server probe intern…
- CVE-2020-37278HIGHCVSS 7.5EG 7.52026-10-02
Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Atta…
- CVE-2026-56661HIGHCVSS 7.5EG 7.52026-10-01
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILT…
- CVE-2023-54402HIGHCVSS 7.5EG 7.52026-09-30
iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value (testtoken) to bypass authenticatio…
- CVE-2026-102091HIGHCVSS 7.5EG 7.52026-09-30
Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. Th…
- CVE-2026-100750HIGHCVSS 7.5EG 7.52026-09-28
Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by …
- CVE-2026-77242HIGHCVSS 7.5EG 7.52026-09-22
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when co…
- CVE-2026-77265HIGHCVSS 7.5EG 7.52026-09-22
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for…
- CVE-2026-80150HIGHCVSS 7.5EG 7.52026-09-22
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listene…
- CVE-2026-85917HIGHCVSS 7.5EG 7.52026-09-17
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-92815HIGHCVSS 7.5EG 7.52026-09-16
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optional_value parameter to retr…
- CVE-2026-92719HIGHCVSS 7.5EG 7.52026-09-16
Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queue_url to …
- CVE-2026-81265HIGHCVSS 7.5EG 7.52026-09-10
IBM Langflow OSS 1.0.0 through 1.11.5.
- CVE-2026-80123HIGHCVSS 7.5EG 7.52026-09-09
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially ex…
- CVE-2026-66304HIGHCVSS 7.5EG 7.52026-09-08
Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.
- CVE-2026-86259HIGHCVSS 7.5EG 7.52026-09-06
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url head…
- CVE-2026-86173HIGHCVSS 7.5EG 7.52026-09-05
MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can by…
- CVE-2026-85699HIGHCVSS 7.5EG 7.52026-09-04
jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal n…
- CVE-2026-85691HIGHCVSS 7.5EG 7.52026-09-04
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without aut…
- CVE-2026-85686HIGHCVSS 7.5EG 7.52026-09-04
ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary image…
- CVE-2026-85675HIGHCVSS 7.5EG 7.52026-09-04
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through …
- CVE-2026-85673HIGHCVSS 7.5EG 7.52026-09-04
LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but …
- CVE-2026-85666HIGHCVSS 7.5EG 7.52026-09-04
OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a server_url parameter (along wi…
- CVE-2026-85608HIGHCVSS 7.5EG 7.52026-09-04
Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query …
- CVE-2026-85612HIGHCVSS 7.5EG 7.52026-09-04
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the A…
- CVE-2026-85609HIGHCVSS 7.5EG 7.52026-09-04
Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts). The endpoint passes a user-supplied url q…
- CVE-2026-85180HIGHCVSS 7.5EG 7.52026-09-03
Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest,…
- CVE-2026-82638HIGHCVSS 7.5EG 7.52026-08-30
jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses …
- CVE-2026-82270HIGHCVSS 7.5EG 7.52026-08-28
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward re…
- CVE-2026-82268HIGHCVSS 7.5EG 7.52026-08-28
Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gr…
- CVE-2026-81678HIGHCVSS 7.5EG 7.52026-08-27
AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can…
- CVE-2026-80347HIGHCVSS 7.5EG 7.52026-08-26
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, an…
- CVE-2026-55525HIGHCVSS 7.5EG 7.52026-08-25
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the web_crawl function validates only the initial URL before _crawl_with_httpx uses httpx.Client(follow_redirects=True). Redirect targets are not revalidated, so an …
Map vulnerabilities like CWE-918 to your infrastructure
EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →