CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- themeum kirkiKirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL4.1 Medium
- microsoft azure sre agentAzure SRE Agent Elevation of Privilege Vulnerability9.6 Critical
- dromara skyeyeDromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById9.1 Critical
- indicoIndico: Incomplete Server-Side Request Forgery (SSRF) check6.8 Medium
- ffmpegFFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling5.3 Medium
- cisa malcolmServer-Side Request Forgery in Malcolm7.1 High
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)6.8 Medium
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently3.7 Low
- ibm datapower gateway 10.5.0, datapower gateway, datapower gateway 10.6.0 +2 more +4 moreIBM DataPower Gateway affected by server-side request forgery4.9 Medium
- dadrus heimdalllinuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to...3.4 Low
- splunk mcp serverServer-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP Server5.3 Medium
- splunk, splunk enterprise +1 moreServer-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability Cloud6.5 Medium
- drupal freelinkingFreelinking - Moderately critical - Information Disclosure - SA-CONTRIB-2026-2134.3 Medium
- @backstage plugin-techdocs-node, backstage +1 moreBackstage: Improper input validation in TechDocs Markdown extension configuration7.7 High
- cisco finesseCisco Finesse Server-Side Request Forgery Vulnerability7.2 High
- gophishGophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site5.3 Medium
- sonicwall sma1000A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due...10.0 Critical
- blubrry powerpress podcasting plugin by blubrryPowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects4.1 Medium
- @backstage plugin-catalog-backend, backstage, linuxfoundation backstage plugin-catalog-backend +2 moreBackstage: Improper URL validation in catalog entity placeholder resolution7.7 High
- aws bedrock-agentcore-starter-toolkitServer-side request forgery and local file read via unrestricted external OpenAPI reference resolution in Bedrock AgentCore Starter Toolkit agent import5.7 Medium
- @backstage plugin-scaffolder-backend-module-sentry, backstage, linuxfoundation backstage\/plugin-scaffolder-backend-module-sentry +2 moreBackstage: Improper input validation in Sentry scaffolder actions8.5 High
- @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 moreBackstage: Improper validation of MkDocs plugin configuration in TechDocs7.7 High
- arista networks cloudvision portalSecurity Advisory 01865.1 Medium
- arista networks cloudvision portalSecurity Advisory 01865.1 Medium
- giteaGitea migration SSRF to reserved addresses through ALLOWED_DOMAINS4.3 Medium
- giteaGitea repository migration SSRF through DNS rebinding7.5 High
- giteaGitea SSRF through Git HTTP redirects in mirrors and fetches7.5 High
- giteaGitea push mirror SSRF and forced writes to internal Git hosts8.1 High
- giteaGitea migration and pull mirror SSRF through multi-answer DNS4.3 Medium
- github enterprise serverServer-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts8.7 High
- i18next i18next-http-backendi18next-http-backend incomplete URL validation permits SSRF3.7 Low
- microsoft ufoMicrosoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects6.4 Medium
langflowPyPI,langflow-basePyPI,lfxPyPI +1 more +3 moreLangflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)6.3 Medium- djangoproject djangoPotential request forgery via spatial lookup byte values6.9 Medium
- instapagedev instapage pluginWordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- deknows pdf smart viewer for elementorWordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability7.2 High
- langgenius difyDify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint8.3 High
- mongodb, inc. mongodb controllers for kubernetesImproper validation of Ops Manager configuration in MongoDB Kubernetes Operator2.3 Low
- docling, docling-project docling-slim +1 moreDocling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)4.0 Medium
- No product listedO2OA General url ActionUploadExcelWithUrl server-side request forgery5.3 Medium
- penpotPenpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download6.0 Medium
- tryghost ghostGhost: Private IP Filtering Bypass via IPv6 Transition Addresses4.0 Medium
- tryghost ghostGhost: Server-Side Request Forgery in Bookmark Fetching4.0 Medium
- makeplane planePlane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)9.9 Critical
- makeplane planePlane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint7.6 High
- makeplane planePlane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU7.7 High
- makeplane planePlane: SSRF in Gitea OAuth8.7 High
- makeplane planePlane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery7.6 High
- cookpete auto-changelogauto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF8.4 High
- eclipse foundation che, the eclipse foundation eclipse che +1 moreIn Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory...8.4 High
- Show moreLoading…