CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- j0hnsmith testimonials widgetTestimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL5.8 Medium
- openclawOpenClaw before 2026.8.1 Server-Side Request Forgery via Video Asset5.3 Medium
- openclawOpenClaw before 2026.8.1 SSRF via Browser Wait Predicates5.3 Medium
- openclawOpenClaw before 2026.8.1 SSRF via Trusted-Host DNS8.2 High
- openclawOpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname8.9 High
- openclawOpenClaw before 2026.8.1 DNS Rebinding via attachment delivery7.1 High
- mhdzumair mediaflow-proxyMediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation8.8 High
- open-metadata openmetadataOpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass5.1 Medium
- zammadZammad: Avatar Image URL Server-Side Request Forwarding5.3 Medium
- gabe livan asset cleanup: page speed boosterAsset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter5.5 Medium
- unknown link libraryLink Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation4.0 Medium
glanceUbuntu,python-glance-storeDebian +1 moreAn issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker...8.1 HighglanceUbuntuA Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack...6.5 Mediumjetty12Debian,jetty9Debian,org.eclipse.jetty:apache-jspTuxCare +126 more +128 moreJetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames8.8 High- destiny.gg chatsongxinjianqwe Chat chat-server ChatServer.java server-side request forgery6.9 Medium
- mongodb python driverForced local Unix socket connection via dot-sock KMS endpoint in client-side field encryption5.3 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl server-side request forgery5.3 Medium
- liketrek trekTREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4)6.3 Medium
- mauriceboe trekTREK: Server-Side Request Forgery via User-Configurable LLM Base URL8.1 High
- termix-ssh termixTermix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist7.7 High
- termix-ssh termixTermix: Authenticated blind SSRF through notification channel test endpoints6.4 Medium
- alam00000 bentopdfBentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass8.6 High
- logto-io logtoLogto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint8.5 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities9.6 Critical
- themeum kirki – freeform page builder, website builder & customizerKirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter5.4 Medium
- No product listedAn issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary...8.8 High
- No product listedmcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF)...9.1 Critical
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 moreAutomation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)6.4 Medium
- verbb formieFormie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials8.5 High
- plex media serverPlex Media Server arbitrary-host SSRF5.3 Medium
- plex media serverPlex Media Server SSRF5.3 Medium
- global it informatics services inc. weollSSRF Leading to JWT Token Disclosure in Global IT Informatics' Weoll6.5 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.9.5 - Subscriber+ SSRF via Avatar URL5.0 Medium
- iflytek astron-agentiFlytek astron-agent debugToolV2 API endpoint UrlCheckTool.checkUrl server-side request forgery5.3 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities7.9 High
- ibm concertMultiple Vulnerabilities in IBM Concert Software6.5 Medium
- github enterprise serverGitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery9.3 Critical
- mattermost, mattermost server +1 moreMattermost server-side request forgery via OAuth endpoints configurable by a System Administrator5.5 Medium
- home-assistant coreHome Assistant: mDNS Server-Side Request Forgery5.4 Medium
- adobe premierePremiere Pro | Server-Side Request Forgery (SSRF) (CWE-918)7.1 High
- adobe aem 6.5 forms jee, aem 6.5 lts forms jee +1 moreAdobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)9.6 Critical
- adobe aem 6.5 forms jee, aem 6.5 lts forms jee +1 moreAdobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)8.7 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Incomplete fix for CVE-2026-27826: redirect-based SSRF via unhooked requests session in Jira user-permission lookup5.3 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: SSRF redirect protection missing for basic-auth and OAuth authentication branches7.1 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)7.5 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moremcp-atlassian has an incomplete SSRF remediation8.3 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: SSRF via DNS Rebinding in Header-Based Authentication Flow5.9 Medium
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)9.9 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)9.9 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)9.6 Critical
- Show moreLoading…