CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

4,202 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 46 of 85

CVE-2025-25827MEDIUMCVSS 6.8EG 6.8
2025-02-26
A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL.
CVE-2024-29173MEDIUMCVSS 6.8EG 6.8
2024-06-26
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a Server-Side Request Forgery (SSRF) vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to d…
CVE-2024-29090MEDIUMCVSS 6.8EG 6.8
2024-03-28
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4.
CVE-2023-26366MEDIUMCVSS 6.8EG 6.8
2023-10-13
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. …
CVE-2021-3959MEDIUMCVSS 6.8EG 6.8
2021-12-16
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Bitdefender GravityZone v…
CVE-2021-37940MEDIUMCVSS 6.8EG 6.8
2021-12-07
An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the G…
CVE-2021-43780MEDIUMCVSS 6.8EG 6.8
2021-11-24
Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advanced methods of Server Side Request Forgery (SSRF). These vuln…
CVE-2021-32698MEDIUMCVSS 6.8EG 6.8
2021-06-21
eLabFTW is an open source electronic lab notebook for research labs. This vulnerability allows an attacker to make GET requests on behalf of the server. It is "blind" because the attacker cannot see the result of the request. Issue has bee…
CVE-2021-22214MEDIUMCVSS 6.8EG 6.8
2021-06-08
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab …
CVE-2026-33486MEDIUMCVSS 6.5EG 6.8
2026-03-26
Roadiz is a polymorphic content management system based on a node system that can handle many types of services. A vulnerability in roadiz/documents prior to versions 2.7.9, 2.6.28, 2.5.44, and 2.3.42 allows an authenticated attacker to re…
CVE-2026-46678MEDIUMCVSS 5.9EG 6.8
2026-05-21
Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into force_download='allow-local' (disabling the default block on private/internal IPs), the…
CVE-2026-63269MEDIUMCVSS 6.7EG 6.7
2026-10-05
LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made GStreamer read the local files and remote URLs it listed while the document lo…
CVE-2026-63267MEDIUMCVSS 6.7EG 6.7
2026-10-05
LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a reques…
CVE-2026-46380MEDIUMCVSS 6.7EG 6.7
2026-05-28
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an atta…
CVE-2020-5014MEDIUMCVSS 6.7EG 6.7
2021-03-08
IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary code on the system using a server-side requesr forgery attack. IBM X-Force ID: 193247.
CVE-2024-27098MEDIUMCVSS 6.4EG 6.7
2024-03-18
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This i…
CVE-2026-53708MEDIUMCVSS 6.6EG 6.6
2026-08-14
ContextForge is an AI gateway, registry, and proxy that provides centralized discovery, guardrails, and management for MCP, A2A, and REST or gRPC APIs. Prior to 1.0.3, the /admin/gateways/test call site in mcpgateway/admin.py calls validat…
CVE-2026-48916MEDIUMCVSS 6.6EG 6.6
2026-05-27
Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.
CVE-2026-48918MEDIUMCVSS 6.6EG 6.6
2026-05-27
Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.
CVE-2024-40441MEDIUMCVSS 6.6EG 6.6
2024-09-23
An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to annotate a document automatically v.0.1.23 allows a remote attacker to escalate privileges via the mod…
CVE-2021-33181MEDIUMCVSS 6.6EG 6.6
2021-06-01
Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticated users to send arbitrary request to intranet resources via unspecified vectors.
CVE-2026-119758MEDIUMCVSS 6.5EG 6.5
2026-11-06
ERPNext OCR app for Frappe/ERPNext through 1.1.1 contains a missing authorization and path traversal vulnerability that allows any authenticated user to read arbitrary server files by passing a fully client-controlled path argument to the …
CVE-2026-123125MEDIUMCVSS 6.5EG 6.5
2026-11-05
The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some internal addresses are accepted as public, which can lead to Server-Side Request Forgery (SSRF) …
CVE-2026-121936MEDIUMCVSS 6.5EG 6.5
2026-11-04
easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and inte…
CVE-2026-116252MEDIUMCVSS 6.5EG 6.5
2026-10-30
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value containing "=" (or a postgresql:// URI) as a full connection string, whose keywords override the h…
CVE-2026-119575MEDIUMCVSS 6.5EG 6.5
2026-10-30
ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.openc…
CVE-2026-116686MEDIUMCVSS 6.5EG 6.5
2026-10-27
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSc…
CVE-2026-116069MEDIUMCVSS 6.5EG 6.5
2026-10-25
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can sub…
CVE-2026-115886MEDIUMCVSS 6.5EG 6.5
2026-10-23
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints, including unauthenticated POST /ajax-a…
CVE-2026-55190MEDIUMCVSS 6.5EG 6.5
2026-10-23
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed…
CVE-2026-17557MEDIUMCVSS 6.5EG 6.5
2026-10-21
A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows f…
CVE-2026-112267MEDIUMCVSS 6.5EG 6.5
2026-10-19
SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstrap_host and bootstrap_port field…
CVE-2026-108764MEDIUMCVSS 6.5EG 6.5
2026-10-19
Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue aff…
CVE-2026-111320MEDIUMCVSS 6.5EG 6.5
2026-10-15
ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider base_url. Attackers can set base_url via the provider…
CVE-2026-111313MEDIUMCVSS 6.5EG 6.5
2026-10-15
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations.…
CVE-2026-96204MEDIUMCVSS 6.5EG 6.5
2026-10-13
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
CVE-2026-70259MEDIUMCVSS 6.5EG 6.5
2026-10-13
Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
CVE-2024-34319MEDIUMCVSS 6.5EG 6.5
2026-10-13
A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request.
CVE-2026-93693MEDIUMCVSS 6.5EG 6.5
2026-10-12
In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting, and insufficient validation on queue service can be chained by a remot…
CVE-2026-76274MEDIUMCVSS 6.5EG 6.5
2026-10-07
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational …
CVE-2026-102777MEDIUMCVSS 6.5EG 6.5
2026-10-05
Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0 - The Google Photos picker of the back-end upload page fetches the thumbnails of the picked images through the se…
CVE-2026-94483MEDIUMCVSS 6.5EG 6.5
2026-10-02
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized i…
CVE-2026-104459MEDIUMCVSS 6.5EG 6.5
2026-10-02
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host …
CVE-2026-104458MEDIUMCVSS 6.5EG 6.5
2026-10-02
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a craft…
CVE-2026-100251MEDIUMCVSS 6.5EG 6.5
2026-10-01
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole…
CVE-2026-100279MEDIUMCVSS 6.5EG 6.5
2026-09-30
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
CVE-2026-100859MEDIUMCVSS 6.5EG 6.5
2026-09-27
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the…
CVE-2026-77112MEDIUMCVSS 6.5EG 6.5
2026-09-23
Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery. This issue affects Weoll: before 3.2.45.44.
CVE-2026-77267MEDIUMCVSS 6.5EG 6.5
2026-09-22
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by _process_authentication_headers and used…
CVE-2026-79913MEDIUMCVSS 6.5EG 6.5
2026-09-22
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternalURL server-side request forgery guard in pkg/request/ssrf.go passes resolved addresses to checkIP without decoding NAT64, IPv4-compatible, …

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →