CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: SSRF Protection Bypass8.8 High
- dgtlmoon changedetection.iodgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery6.9 Medium
- labring fastgptFastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests6.3 Medium
- hkuds lightragLightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard7.1 High
- novuhq novu, @novu api-service +1 moreNovu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs5.3 Medium
- cloudreveCloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses6.5 Medium
- lantronix emg7500, emg8500, slb882 +2 more +4 moreLantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter7.7 High
- lantronix emg7500, emg8500, slb882 +2 more +4 moreLantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter7.7 High
- lantronix emg7500, emg8500, slb882 +2 more +4 moreLantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation7.7 High
- mispMISP Unauthenticated Blind SSRF via XML Body Processing6.9 Medium
- tauri tauri-plugin-httpTauri framework v2 SSRF Protection Bypass via HTTP Redirects5.6 Medium
- 1panel-dev maxkbMaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)4.3 Medium
- inventreeInvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure6.5 Medium
- sysadminsmedia homeboxHomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress6.0 Medium
- ondata ckan-mcp-server@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-535095.7 Medium
- jgraph drawiodraw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js7.7 High
- jgraph drawiodraw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist6.8 Medium
- hatchet-dev hatchetHatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler4.1 Medium
- mispMISP Arbitrary Local File Read and SSRF via MISP Export Upload8.3 High
- No product listedA Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows...6.5 Medium
- No product listedCuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php --...9.1 Critical
- 0717376 cowork bench0717376 cowork_bench pdf-tools-mcp server.py ControlFlowNode server-side request forgery5.3 Medium
- vas3k taxhackervas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery6.9 Medium
- vas3k taxhackervas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery6.9 Medium
- noncegeek dim-sum-appNonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery6.9 Medium
- mealie-recipes mealiemealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery5.3 Medium
- carazo import and export users and customersImport and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar4.1 Medium
- wowelements wow elements addons for elementorWow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting6.5 Medium
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +8 more +10 moreOpenshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint9.3 Critical
- 1panel-dev cordyscrmCordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime6.8 Medium
- ibm iIBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]6.4 Medium
- obot-platform obotObot before v0.23.0 Server-Side Request Forgery via MCP8.3 High
- internlm lmdeployLMDeploy URL parser disagreement permits SSRF filter bypass7.5 High
- No product listedSveltyCMS File Upload Endpoint upload-media server-side request forgery5.3 Medium
- opencveOpenCVE: Server-Side Request Forgery (SSRF) in notifications6.5 Medium
- arcadedata arcadedbArcadeDB before 26.9.1 SSRF via IPv6 transition addresses5.3 Medium
- synology diskstation manager (dsm)A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation...4.3 Medium
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.9.3 Critical
- airani auto upload imagesAuto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags6.4 Medium
- unknown generate pdf using contact form 7Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field5.8 Medium
- devolutions serverCircles' remote-instance signature verification fetches the attacker-supplied keyId URL before...6.2 Medium
- microsoft azure ai foundry, foundry +1 moreAzure AI Foundry Elevation of Privilege Vulnerability7.5 High
- prebid prebid-server-javaPrebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction10.0 Critical
- givanz vvvebVvveb oEmbedProxy vulnerable to server-side request forgery8.4 High
- google chromeServer-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52...3.7 Low
- leslieleung gleanGlean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover7.7 High
- edwardkim rhwprhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages4.7 Medium
- netbox-community devicetype-libraryNetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI5.3 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools7.1 High
- nuxt-modules og-imageNuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter6.9 Medium
- Show moreLoading…