CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
3,009 vulnerabilities with CWE-918
CVE-2026-56348
CRITICAL
n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint
CVSS 9.1
CVE-2026-56266
HIGH
Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints
CVSS 8.6
CVE-2026-55599
MEDIUM
phpseclib: X.509 certificate validation sends attacker-controlled outbound requests (server-side request forgery) via Authority Information Access
CVSS 5.8
CVE-2026-54300
MEDIUM
@astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config
CVSS 5.3
CVE-2026-54299
HIGH
Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)
CVSS 7.5
CVE-2026-50168
HIGH
Angular: URL Parser Differential in @angular/platform-server leading to SSRF Allowlist Bypass
CVSS 8.2
CVE-2026-46417
MEDIUM
Angular: SSRF via Hostname Hijacking in @angular/platform-server
CVSS 6.1
CVE-2026-9006
HIGH
IBM WebSphere Application Server is affected by server-side request forgery
CVSS 7.4
CVE-2026-12813
MEDIUM
activepieces File URL file.ts handleUrlFile server-side request forgery
CVSS 6.3
CVE-2026-12798
MEDIUM
BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery
CVSS 6.3
CVE-2026-12774
MEDIUM
BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery
CVSS 6.3
CVE-2026-56342
MEDIUM
AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter
CVSS 6.8
CVE-2026-56227
MEDIUM
Capgo - Server-Side Request Forgery via Webhook URL Validation
CVSS 5.4
CVE-2026-49345
MEDIUM
Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)
CVE-2026-12726
MEDIUM
Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential
CVSS 6.3
CVE-2026-49359
MEDIUM
PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment option
CVSS 6.5
CVE-2026-4328
MEDIUM
Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter
CVSS 6.4
CVE-2026-11989
MEDIUM
Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping
CVSS 6.5
CVE-2026-54017
HIGH
Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal
CVSS 7.7
CVE-2026-11395
HIGH
CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host
CVSS 7.2
CVE-2026-48764
HIGH
TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass
CVSS 8.2
CVE-2026-12566
LOW
SSRF via unvalidated WWW-Authenticate realm in docker_pull module
CVSS 3.1
CVE-2026-48818
HIGH
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
CVSS 7.5
CVE-2026-48782
MEDIUM
Pydantic AI - Cloud Metadata Server-Side Request Forgery Blocklist Bypass
CVSS 6.8
CVE-2026-53859
MEDIUM
OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency
CVSS 6.5
Details
Vulnerabilities
3,009