CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- cosmicstack-labs mercury-agentcosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery5.3 Medium
- suitenumerique docsDocs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint6.9 Medium
- hcengineering platformHuly Platform through 0.7.426 SSRF via Print Service6.3 Medium
october/octoberPackagistOctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery6.9 Medium- a2aproject a2a-pythona2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery5.3 Medium
- taisan tarzan-cmstaisan tarzan-cms Theme Download Function ThemeService.java openConnection server-side request forgery6.9 Medium
- openstack glanceIn OpenStack Glance before 32.0.1, the location API does not validate destination hosts when...7.0 High
- flowiseai flowiseFlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery5.3 Medium
- lfnovo open-notebookOpen Notebook before 1.11.0 Server-Side Request Forgery via link-source8.3 High
- openstatushq openstatusopenstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery5.3 Medium
- @frontmcp adapters, agentfront frontmcp, mcp-from-openapi +2 moremcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi8.5 High
- cisa malcolmServer-Side Request Forgery in Malcolm5.3 Medium
- shelf-nu shelf.nuShelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass7.1 High
- wwbn avideoWWBN AVideo Unauthenticated SSRF via login.json.php6.9 Medium
- google cloud gemini enterprise agent platform app builderSSRF in Gemini Enterprise Agent Platform App Builder8.7 High
mistralrs-server-corecrates.iomistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url7.2 High- transmute-app transmuteTransmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects6.5 Medium
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches5.0 Medium
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.5 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches8.6 High
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches7.5 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities due to open source software8.8 High
- ibm websphere application serverIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities5.3 Medium
- angularAngular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR8.6 High
- aws amazon ssm agentServer-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent8.5 High
- espocrmEspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass6.9 Medium
- openpanel-dev openpanelOpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch5.3 Medium
github.com/komari-monitor/komariGoKomari: Management Interface CSRF8.8 High- geonetwork core-geonetworkGeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool7.8 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets5.0 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader7.7 High
- kozea weasyprintWeasyPrint restrictive URL fetcher bypass allows local file read and SSRF6.2 Medium
github.com/lf-edge/ekuiperGo,github.com/lf-edge/ekuiper/v2Go,govulncheck-vulndbopenSUSE +2 moreLF Edge eKuiper: SSRF in External Service5.5 Medium- drupal saml sso - service providerSAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-1513.3 Low
- schneider electric ecostruxure™ it data center expert (formerly known as struxureware data center expert)CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized...8.6 High
- grokability snipe-itSnipe-IT before 8.7.0 Server-Side Request Forgery via employee_num8.3 High
- laradashboardLara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch7.1 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...7.3 High
- apache impalaApache Impala: Secrets Exfiltration via SSRF8.8 High
- apache impalaApache Impala: Avro Schema URL Server-Side Request Forgery5.3 Medium
- yordam informatics technology consulting, training, and electronic systems industry and trade inc. library information and document automation programSSRF in Yordam Informatics's Library Automation System5.3 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...7.3 High
- tanium enforceTanium addressed a server-side request forgery vulnerability in Enforce.7.7 High
- google chromeServer-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote...9.8 Critical
- n8nn8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node7.1 High
- nodemailerNodemailer before 9.1.1 Security Sandbox Bypass via resolveContent6.0 Medium
- opengeos geolibreopengeos GeoLibre _is_within_roots server-side request forgery6.9 Medium
- microsoft skype for business server 2015 cu13, skype for business server 2019 cu8, skype for business server subscription edition cu1 +2 more +4 moreSkype for Business Information Disclosure Vulnerability7.5 High
- n8nn8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content5.9 Medium
- Show moreLoading…