CWE-918— Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog
2,794 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-918page 43 of 56
- CVE-2026-24242HIGHCVSS 7.8EG 7.82026-07-01
NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.
- CVE-2026-24316MEDIUMCVSS 6.4EG 6.42026-03-10
SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF…
- CVE-2026-24360MEDIUMCVSS 4.4EG 4.62026-01-22
Server-Side Request Forgery (SSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Server Side Request Forgery.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.1.
- CVE-2026-24381MEDIUMCVSS 5.4EG 5.42026-01-22
Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through < 5.7.2.
- CVE-2026-24470HIGHCVSS 8.1EG 8.12026-01-26
Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes t…
- CVE-2026-24548MEDIUMCVSS 5.4EG 5.42026-01-23
Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.91.
- CVE-2026-24639MEDIUMCVSS 4.4EG 4.42026-07-23
Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.
- CVE-2026-24736CRITICALCVSS 9.1EG 9.12026-01-27
Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define "Webhooks" as actions within the Rules engine. The url parameter in the w…
- CVE-2026-24767MEDIUMCVSS 4.9EG 4.92026-01-28
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery (SSRF) vulnerability exists in the `uploadViaURL` functionality due to an unprotected `HEAD` request. While the subseq…
- CVE-2026-24779HIGHCVSS 7.1EG 7.12026-01-27
vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request Forgery (SSRF) vulnerability exists in the `MediaConnector` class within the vLLM project's multimodal feature set. Th…
- CVE-2026-2479MEDIUMCVSS 5.0EG 5.02026-02-25
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.1. This is due to the use of `strpos()` for substring-based hostname validation instead of strict…
- CVE-2026-24902HIGHCVSS 7.1EG 7.12026-01-29
TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0.9.114. In `tcp_forwarder.rs`, SSRF protection for `allow_private_network_connections = false` w…
- CVE-2026-24961MEDIUMCVSS 5.4EG 5.42026-02-03
Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Server Side Request Forgery.This issue affects Grand Blog: from n/a through < 3.1.5.
- CVE-2026-24964MEDIUMCVSS 6.4EG 6.42026-03-25
Server-Side Request Forgery (SSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Server Side Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.1.2.1.
- CVE-2026-25123MEDIUMCVSS 5.3EG 5.32026-02-06
Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an arbitrary url and performs a server-side request to that URL. This allows an unauthenticated attacker to trigger outbo…
- CVE-2026-2531MEDIUMCVSS 6.3EG 6.32026-02-16
A security vulnerability has been detected in MindsDB up to 25.14.1. This vulnerability affects the function clear_filename of the file mindsdb/utilities/security.py of the component File Upload. Such manipulation leads to server-side requ…
- CVE-2026-25310MEDIUMCVSS 4.9EG 4.92026-02-19
Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.This issue affects Extend Link: from n/a through <= 2.0.0.
- CVE-2026-2532MEDIUMCVSS 6.3EG 6.32026-02-16
A vulnerability was detected in lintsinghua DeepAudit up to 3.0.3. This issue affects some unknown processing of the file backend/app/api/v1/endpoints/embedding_config.py of the component IP Address Handler. Performing a manipulation resul…
- CVE-2026-25385MEDIUMCVSS 5.5EG 5.52026-02-19
Server-Side Request Forgery (SSRF) vulnerability in KaizenCoders URL Shortify url-shortify allows Server Side Request Forgery.This issue affects URL Shortify: from n/a through <= 1.12.3.
- CVE-2026-25428MEDIUMCVSS 4.4EG 4.42026-02-19
Server-Side Request Forgery (SSRF) vulnerability in totalsoft TS Poll poll-wp allows Server Side Request Forgery.This issue affects TS Poll: from n/a through <= 2.5.5.
- CVE-2026-25492MEDIUMCVSS 6.5EG 6.52026-02-09
Craft CMS is a content management system. In Craft versions 3.5.0 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the save_images_Asset GraphQL mutation can be abused to fetch internal URLs by providing a domain name that resolves to an inte…
- CVE-2026-25493MEDIUMCVSS 6.5EG 6.52026-02-09
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation validates the initial URL hostname and resolved IP against a blocklist, but Guzz…
- CVE-2026-25494MEDIUMCVSS 6.5EG 6.52026-02-09
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the saveAsset GraphQL mutation uses filter_var(..., FILTER_VALIDATE_IP) to block a specific list of IP address…
- CVE-2026-25511MEDIUMCVSS 4.9EG 4.92026-02-04
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, and 26.0.5, an authenticated user within the System Administrator group can trigger a full SSRF via the WOPI service dis…
- CVE-2026-25528MEDIUMCVSS 5.8EG 5.82026-02-09
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. The LangSmith SDK's distributed tracing feature is vulnerable to Server-Side Request Forgery via malicious HTTP headers. An attacker can inject arbitrary api_…
- CVE-2026-2556MEDIUMCVSS 6.3EG 6.32026-02-16
A security vulnerability has been detected in cskefu up to 8.0.1. This issue affects some unknown processing of the file com/cskefu/cc/controller/resource/MediaController.java of the component Endpoint. The manipulation of the argument url…
- CVE-2026-2558MEDIUMCVSS 6.3EG 6.32026-02-16
A flaw has been found in GeekAI up to 4.2.4. The affected element is the function Download of the file api/handler/net_handler.go. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack …
- CVE-2026-25580HIGHCVSS 8.6EG 8.62026-02-06
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When ap…
- CVE-2026-25765MEDIUMCVSS 5.8EG 5.82026-02-09
Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's build_exclusive_url method (in lib/faraday/connection.rb) uses Ruby's URI#merge to combine the connection's…
- CVE-2026-25870MEDIUMCVSS 5.8EG 5.82026-02-10
DoraCMS version 3.1 and prior contains a server-side request forgery (SSRF) vulnerability in its UEditor remote image fetch functionality. The application accepts user-supplied URLs and performs server-side HTTP or HTTPS requests without s…
- CVE-2026-25883MEDIUMCVSS 5.8EG 5.82026-04-20
Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa webhook feature allows authenticated users to configure an arbitrary URL that receives HTTP POST requests when meeti…
- CVE-2026-25904MEDIUMCVSS 5.8EG 5.82026-02-09
The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python code to access the localhost interface of the host to perform SSRF attacks. Note - the "mcp-run-pytho…
- CVE-2026-25960CRITICALCVSS 9.8EG 9.82026-03-09
vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the valid…
- CVE-2026-25991HIGHCVSS 7.7EG 7.72026-02-13
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, there is a Blind Server-Side Request Forgery (SSRF) vulnerability in the Cookmate recipe import feature of Tandoor Recipes…
- CVE-2026-26005MEDIUMCVSS 5.0EG 5.02026-02-12
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #45, in Clip Bucket V5, The Remote Play allows creating video entries that reference external video URLs without uploading the video files to the server. However, by …
- CVE-2026-26013LOWCVSS 3.7EG 3.72026-02-10
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-e…
- CVE-2026-26019MEDIUMCVSS 4.1EG 4.12026-02-11
LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled b…
- CVE-2026-26118HIGHCVSS 8.8EG 8.82026-03-10
Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-26120MEDIUMCVSS 6.5EG 6.52026-03-19
Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-26121HIGHCVSS 7.5EG 7.52026-03-10
Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-26135HIGHCVSS 8.8EG 9.62026-04-03
Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.
- CVE-2026-26137CRITICALCVSS 9.9EG 9.92026-03-19
Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network.
- CVE-2026-26138HIGHCVSS 8.6EG 8.62026-03-19
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-26139HIGHCVSS 8.6EG 8.62026-03-19
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-26150HIGHCVSS 8.6EG 8.62026-04-23
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-26338CRITICALCVSS 9.8EG 9.82026-02-19
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality.
- CVE-2026-26339CRITICALCVSS 9.8EG 9.82026-02-19
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.
- CVE-2026-26379MEDIUMCVSS 6.5EG 6.52026-06-03
Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. This allows authenticated attackers to perform internal network scanning and identify running services by analyzi…
- CVE-2026-2654MEDIUMCVSS 6.3EG 6.32026-02-18
A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to …
- CVE-2026-2711MEDIUMCVSS 5.6EG 5.62026-02-19
A vulnerability has been found in zhutoutoutousan worldquant-miner up to 1.0.9. The impacted element is an unknown function of the file worldquant-miner-master/agent-dify-api/core/helper/ssrf_proxy.py of the component URL Handler. The mani…
Map vulnerabilities like CWE-918 to your infrastructure
EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →