CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- mervinpraison praisonaiPraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-401147.1 High
- red hat ansible automation platform 2Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction6.4 Medium
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)8.5 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: SSRF via redirect-following in praisonaiagents web_crawl7.5 High
- apache hiveApache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url9.1 Critical
- nltkNLTK before 3.10.3 SSRF Protection Bypass via Proxy8.7 High
- vrana adminerAdminer before 5.5.0 SSRF via PDO DSN Injection6.9 Medium
- fasterxml com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind +1 morejackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)5.3 Medium
- hieventsdev hi.eventsHi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects8.4 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAwx: notification backends allow ssrf and credential leakage7.7 High
- ransomlookRansomLook Analysis PDF Generation Allows Server-Side Request Forgery and Arbitrary Local File Access8.2 High
- wp manageninja llc fluentcrm proWordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- tammersoft shared filesWordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- gohugoio hugoHugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation8.3 High
- bentomlBentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space6.9 Medium
- vas3k taxhackervas3k TaxHacker Email Sync imap-client.ts buildImapConfig server-side request forgery5.3 Medium
- nltkNLTK before 3.10.0 SSRF via DNS Resolution Failure6.9 Medium
- mailgun for wordpress, unknown mailgun for wordpress +1 moreMailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys9.8 Critical
- unleashUnleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers5.5 Medium
- volcengine openvikingOpenViking < 0.3.4 SSRF via /api/v1/resources8.3 High
- microsoft azure sql databaseAzure SQL Database Elevation of Privilege Vulnerability10.0 Critical
- arraytics eventinEventin < 4.1.21 - Contributor+ Server-Side Request Forgery2.7 Low
- headroom labs headroomHeadroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation7.7 High
- apache cloudstackApache CloudStack: RCE and SSRF in direct download, metalink and NFS templates8.8 High
- apache cloudstackApache CloudStack: Server-Side Request Forgery (SSRF) vulnerability in webhook module9.1 Critical
- apache cloudstackApache CloudStack: Authenticated pre-validation SSRF in registerTemplate4.3 Medium
- openstack glanceIn OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass...2.2 Low
- ptc flexplm, windchill pdmlink +1 moreServer Side Request Forgery (SSRF) vulnerability reported in Windchill7.7 High
- langchain-ai langchain-communitylangchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery7.7 High
- lightdashLightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery5.3 Medium
- microsoft copilot in azure, azure copilot +1 moreMicrosoft Copilot in Azure Information Disclosure Vulnerability7.7 High
- microsoft azure virtual machinesAzure Virtual Machines Elevation of Privilege Vulnerability8.5 High
- microsoft azure data factoryAzure Data Factory Information Disclosure Vulnerability8.6 High
- mauriceboe trekTREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution5.3 Medium
- microsoft entra id, entra +1 moreMicrosoft Entra ID Elevation of Privilege Vulnerability9.9 Critical
- microsoft exchange online, microsoft exchange online +1 moreMicrosoft Exchange Online Elevation of Privilege Vulnerability10.0 Critical
- decolua 9router9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable6.3 Medium
- unstructured-io unstructuredunstructured: Server-Side Request Forgery in the URL-based partitioning9.3 Critical
- udecode platePlate: SSRF with response disclosure in DOCX image embedding8.2 High
- op-engineering link-preview-jslink-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-438977.5 High
- apache inlongApache InLong: Authenticated SSRF via POST /api/node/testConnection5.4 Medium
- atutorServer-Side Request Forgery in ATutor5.1 Medium
- n8nn8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool6.3 Medium
- n8nn8n before 1.123.69 SSRF Protection Bypass via OAuth22.3 Low
- omnivore-app omnivoreOmnivore Stored Server-Side Request Forgery via the setWebhook Mutation5.3 Medium
- omnivore-app omnivoreOmnivore Server-Side Request Forgery via the scanFeeds GraphQL Query5.3 Medium
- aeternalabshq pullmdAeternaLabsHQ PullMD REST API Endpoint api server-side request forgery6.9 Medium
- splunk connect for kafkaServer-Side Request Forgery (SSRF) through the REST API in Splunk Connect for Kafka8.2 High
- cisco talos intelligence for enterprise security cloud, splunk cisco talos intelligence for enterprise security cloud +1 moreServer-Side Request Forgery (SSRF) through the REST API in Cisco Talos Intelligence for Enterprise Security Cloud8.8 High
- splunk soarServer-Side Request Forgery (SSRF) through the Connectivity Check REST API in Splunk SOAR2.7 Low
- Show moreLoading…