CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- osgeo geoserver, geoserver org.geoserver.web:gs-web-app, org.geoserver:gs-main +2 moreGeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution6.5 Medium
- openclawOpenClaw < 2026.5.18 - Private-Network Navigation Bypass via Browser Act Interactions4.9 Medium
- steipete summarizeSummarize < 0.17.0 SSRF via podcast:transcript URL fetch6.3 Medium
- garlic-signage garlic-hubGarlic-Hub: SSRF vulnerability in uploadFromUrl endpoint7.7 High
- stefanbohacek fediverse-embeds-wordpress-pluginFediverse Embeds: Unauthenticated SSRF / open proxy via REST media-proxy endpoint7.5 High
- stefanbohacek fediverse-embeds-wordpress-pluginFediverse Embeds: Public-nonce SSRF via ftf_get_site_info AJAX action5.3 Medium
- learningequality kolibriKolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset5.8 Medium
- ibm langflow desktop, langflow desktop +1 moreIBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services5.4 Medium
- guzzle psr7, guzzlephp psr-7 +1 moreguzzlehttp/psr7 has Host Confusion via Authority Reinterpretation5.3 Medium
- gitlabServer-Side Request Forgery (SSRF) in GitLab5.3 Medium
- broadcom spring web services, spring web services +1 moreSpring WS SSRF via unvalidated WS-Addressing reply destinations8.6 High
- @fedify fedify, vocab-runtime +1 moreFedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges8.6 High
- weblateorg weblateWeblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96)5.9 Medium
- splunk, splunk cloud platform, enterprise +2 moreServer-Side Request Forgery (SSRF) through Dashboard Studio PDF Export in Splunk Enterprise7.6 High
- erlang ftp, otp, erlang\/inets +1 more +3 moreftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks6.3 Medium
- roxy-wiRoxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPs6.5 Medium
- papra-hq papraPapra: SSRF via HTTP redirect bypass in webhook delivery3.5 Low
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)10.0 Critical
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability8.8 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Information Disclosure Vulnerability8.1 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Information Disclosure Vulnerability5.0 Medium
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Spoofing Vulnerability6.5 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Server-Side Request Forgery via UriComponentsBuilder4.2 Medium
- basekick-labs arcArc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks7.1 High
- frangoteam fuxaFUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading8.2 High
- jishenghua jsherpjishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery5.1 Medium
- perfree go-fastdfs-webperfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery6.9 Medium
- altium 365, enterprise server +1 moreServer-Side Request Forgery in Altium Platform Design GraphQL Service Allows Information Disclosure8.3 High
- devolutions serverSync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP7.7 High
- nocodbNocoDB: Server-Side Request Forgery via Database Connection Host5.3 Medium
- siderolabs omniOmni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic2.7 Low
- linqi gmbh linqiServer-Side Request Forgery (SSRF) allowing Internal Network Probing in linqi5.3 Medium
- wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patternsGutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery7.2 High
- runzero platform, shopware +1 moreShopware: SSRF in Media External-Link Endpoint Bypasses IP Validation4.1 Medium
- tautulliTautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay9.9 Critical
- crmeb javacrmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery6.9 Medium
- docling docling-coreDocling Core has unsafe remote filename resolution8.6 High
- docling, red hat openshift ai (rhoai) +1 moreDocling: Unsafe Playwright-based HTML Rendering8.2 High
- cisco unified communications managerCisco Unified Communications Manager Server-Side Request Forgery Vulnerability8.6 High
- kohaAn issue in Koha v.25.11 and before allows a remote attacker to execute arbitrary code via the...6.5 Medium
- wonderwhy-er desktopcommandermcpwonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery5.3 Medium
- ahujasid blender-mcpahujasid blender-mcp ZIP File server.py requests.get server-side request forgery5.3 Medium
- medplumMedplum < 5.1.14 SSRF via FHIR Subscription Endpoint6.3 Medium
- appsmithAppsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter5.1 Medium
- appsmithCVE-2026-72996.3 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery5.1 Medium
- No product listedDedeCMS download.php base64_decode server-side request forgery5.3 Medium
- hkuds nanobotNanobot < 0.2.1 SSRF via Microsoft Teams Channel serviceUrl Poisoning7.0 High
- sourcecodester seo meta tag extractorSourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery6.9 Medium
- hkuds nanobotNanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following5.3 Medium
- Show moreLoading…