CWE-918

Server-Side Request Forgery (SSRF)

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

3,006 vulnerabilities with CWE-918
CVE-2026-28385 MEDIUM
SSRF via image import from URL allows internal network probing by authenticated users
CVSS 5.0
CVE-2026-57627 MEDIUM
WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability
CVSS 4.9
CVE-2026-56026 MEDIUM
WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability
CVSS 6.4
CVE-2026-4339 MEDIUM
SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server
CVSS 6.5
CVE-2026-57940 LOW
Danpros HTMLy - Server-Side Request Forgery (SSRF)
CVE-2026-2053 HIGH
Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager
CVSS 8.3
CVE-2026-8661 MEDIUM
Server-Side Cross-Site Scripting and SSRF in Rapid7 InsightConnect Markdown to PDF Plugin
CVSS 4.8
CVE-2026-13318 MEDIUM
Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip
CVSS 6.4
CVE-2026-12992 HIGH
Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation
CVSS 7.4
CVE-2026-12473 HIGH
OHIF Viewers DICOM Server-Side request forgery
CVSS 8.2
CVE-2026-56779 MEDIUM
MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
CVSS 6.4
CVE-2026-56771 HIGH
NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint
CVSS 8.5
CVE-2026-56769 HIGH
Huly Platform - Server-Side Request Forgery via /import Endpoint
CVSS 8.5
CVE-2026-55412 HIGH
ToolJet Cloud - SSRF to Azure Cloud Infrastructure Compromise
CVSS 8.3
CVE-2026-54033 HIGH
LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs
CVSS 7.7
CVE-2026-55455 CRITICAL
Appsmith: SSRF in REST API / GraphQL datasource plugins via insufficient host denylist
CVSS 9.1
CVE-2026-50189 HIGH
Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route
CVSS 7.2
CVE-2026-49979 LOW
Appsmith: SSRF via `POST /api/v1/admin/send-test-email` — JavaMail Bypasses WebClient IP Filter
CVSS 2.7
CVE-2026-52805 HIGH
Gogs: Migration Redirect Bypass Leads to Internal Repository Theft
CVSS 8.7
CVE-2026-47267 HIGH
Gogs: SSRF in webhook deliveries
CVSS 8.3
CVE-2026-47389 HIGH
Mastodon: SSRF protection bypass on older Ruby versions
CVSS 8.6
CVE-2026-46348 HIGH
Mastodon: SSRF Bypass via IPv6 Unspecified Address (::)
CVE-2026-53946 MEDIUM
Ghost: Mobiledoc image-size fetch SSRF
CVSS 5.4
CVE-2026-53945 MEDIUM
Ghost: Server-side request forgery via DNS rebinding in external request handling
CVSS 4.0
CVE-2026-53944 MEDIUM
Ghost: Private IP filtering bypass to make server-side requests to internal services
CVSS 5.8
Details
Vulnerabilities 3,006
Links
MITRE CWE Entry Search this CWE With Exploits