CWE-918: Server-Side Request Forgery
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Also known as XSPA, SSRF.
A kind of CWE-441 Unintended Proxy or Intermediary.
From the CWE List. © The MITRE Corporation.
Newest
- webtoffee product import export for woocommerceWebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects5.1 Medium
- apache software foundation camelApache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name4.8 Medium
- foxit software inc. foxit.comSSRF and JavaScript Execution in the Foxit Official Website's HTML-to-PDF Service7.5 High
- dfm feedfinder2dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery6.9 Medium
- maotoumao musicfreedesktopmaotoumao MusicFreeDesktop Request Forwarder server-side request forgery5.3 Medium
- wwbn avideo-encoderAVideo-Encoder: unauthenticated full-response server-side request forgery8.6 High
- mrblomblo blombooruBlombooru: administrator image-proxy server-side request forgery6.2 Medium
- capricorn86 happy-domHappy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML8.6 High
- capricorn86 happy-dom@happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy7.5 High
- red hat openshift ai (rhoai)Kserve: kserve: server-side request forgery via malicious storageuri7.7 High
mcp-sanitizernpmmcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv68.2 High- endatixEndatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)4.7 Medium
- wso2 saml2 sso authenticator ui bundle, api manager, carbon ui +4 more +6 moreServer Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources8.3 High
- n8n-io n8nn8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger6.9 Medium
- grafana enterprise, oss +1 moreAzure Monitor access token disclosure via SSRF7.7 High
- hcl software bigfix aexHCL BigFix AEX is affected by multiple security vulnerabilities.4.2 Medium
- unknown customer engagement systemSmart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup5.8 Medium
- tencent weknoraWeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses6.0 Medium
- modelcontextprotocol python-sdkModel Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas6.5 Medium
- strapi open source and enterprise headless cmsCVE-2026-1181726.1 Medium
- sysadminsmedia homeboxHomebox generic notifier SSRF via HTTP redirect after URL validation6.4 Medium
- dani-garcia vaultwardenVaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs5.8 Medium
- nextcloud whiteboardA SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploi…4.6 Medium
- artalkjs artalkArtalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch6.9 Medium
- nvidia tensorrt-llmNVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request...7.1 High
- nvidia tensorrt-llmNVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request...7.1 High
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release...5.8 Medium
- esaqa gmbh psonoUser-controlled Duo host permits authenticated SSRF in Psono Server5.4 Medium
- yeswikiYesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import8.2 High
- yeswikiYesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile8.2 High
- mattermost, mattermost server +1 moreMattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator2.7 Low
- benoitc hackneySSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney6.9 Medium
- No product listedKameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery5.1 Medium
- frappe builderFrappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect5.3 Medium
- frappe builderFrappe Builder before 1.36.1 SSRF via convert_to_webp6.3 Medium
- geesondog rhaphpgeesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery6.9 Medium
- fr0tt benotesfr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery5.3 Medium
- No product listedEyouCMS function.php remote_file_to_local server-side request forgery6.9 Medium
- collabora kodexplorerKodCloud KodExplorer Remote Download web.function.php request_url_safe server-side request forgery5.3 Medium
- yeswikiYesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax6.9 Medium
- rclonerclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots8.2 High
- thorsten phpmyfaqphpMyFAQ before 4.1.10 SSRF via PDF Export Image Fetching5.3 Medium
- vllmvLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector8.8 High
- albert-weasker niubigeoNiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field6.9 Medium
- firecrawlFirecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service7.0 High
- zylon privategptZylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery6.9 Medium
- mlflowMLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints6.5 Medium
- aws multi-model-serverServer-side request forgery in the model download path in Amazon Web Services Multi Model Server6.9 Medium
- tandoorrecipes recipesTandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL6.3 Medium
- intranda goobi-viewer-coreUnauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer9.8 Critical
- Show moreLoading…