CWE-918

Server-Side Request Forgery (SSRF)

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

2,678 vulnerabilities with CWE-918
CVE-2026-26150 HIGH
Microsoft Purview eDiscovery Elevation of Privilege Vulnerability
CVSS 8.6
CVE-2026-41272 HIGH
Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
CVSS 7.1
CVE-2026-41271 HIGH
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
CVSS 7.1
CVE-2026-41270 HIGH
Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
CVSS 7.1
CVE-2026-41461 HIGH
SocialEngine <= 7.8.0 Blind SSRF via /core/link/preview
CVSS 8.5
CVE-2026-41455 HIGH
WeKan < 8.35 SSRF via Webhook URL
CVSS 8.5
CVE-2026-41177 MEDIUM
Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction
CVSS 5.5
CVE-2026-41172 HIGH
Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api/apps/{app}/assets)
CVE-2026-41171 HIGH
SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" HttpClient
CVE-2026-41170 HIGH
Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Internal and External Requests
CVE-2026-35548 HIGH
guardsix ODBC Enrichment Plugins <5.2.1 - Auth Bypass
CVSS 8.5
CVE-2026-41130 MEDIUM
Craft CMS resource-js Endpoint - Server-Side Request Forgery
CVE-2026-41129 MEDIUM
Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads Mutations
CVE-2026-5921 HIGH
Server-Side Request Forgery in GitHub Enterprise Server allowed extraction of sensitive environment variables via timing side-channel attack
CVSS 8.9
CVE-2026-41060 HIGH
AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
CVSS 7.7
CVE-2026-41055 HIGH
WWBN AVideo LiveLinks Proxy - Server-Side Request Forgery
CVSS 8.6
CVE-2026-6744 MEDIUM
Bagisto Downloadable Link copy server-side request forgery
CVSS 6.3
CVE-2026-40566 MEDIUM
FreeScout vulnerable to SSRF via IMAP/SMTP Connection Test Endpoints
CVSS 4.1
CVE-2026-41302 HIGH
OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download
CVSS 7.6
CVE-2026-41297 HIGH
OpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirect
CVSS 7.6
CVE-2026-35587 HIGH
Glances IP Plugin has SSRF via public_api that leads to credential leakage
CVSS 8.8
CVE-2026-33626 HIGH
LMDeploy Vulnerable to Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
CVSS 7.5
CVE-2026-34428 HIGH
Vvveb < 1.0.8.1 SSRF via oEmbedProxy
CVSS 7.7
CVE-2026-25883 MEDIUM
Vexa <0.10.0-260419-1910 Webhooks - Server-Side Request Forgery
CVSS 5.8
CVE-2026-6649 MEDIUM
Qibo CMS headers server-side request forgery
CVSS 6.3
Details
Vulnerabilities 2,678
Links
MITRE CWE Entry Search this CWE With Exploits