CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
2,681 vulnerabilities with CWE-918
CVE-2026-33715
HIGH
Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action
CVSS 7.2
CVE-2026-38527
HIGH
Krayin Laravel CRM - Server-Side Request Forgery via Webhooks Create Endpoint
CVSS 8.5
CVE-2026-34225
MEDIUM
Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality
CVSS 4.3
CVE-2026-39418
MEDIUM
MaxKB: SSRF via sandbox network hook bypass
CVSS 5.0
CVE-2026-6220
MEDIUM
HummerRisk Video File Download URL ServerService.java ServerService.addServer server-side request forgery
CVSS 4.7
CVE-2026-33659
LOW
EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access
CVSS 3.5
CVE-2026-6215
MEDIUM
DbGate REST/GraphQL openApiDriver.ts apiServerUrl1 server-side request forgery
CVSS 6.3
CVE-2026-33534
MEDIUM
EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation
CVSS 4.3
CVE-2026-34476
HIGH
Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header in MCP Server
CVSS 7.1
CVE-2026-5936
HIGH
Server-Side Request Forgery (SSRF) via URL Parameter in Foxit PDF Services API
CVSS 8.5
CVE-2026-6119
MEDIUM
AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery
CVSS 6.3
CVE-2026-6111
MEDIUM
FoundationAgents MetaGPT common.py decode_image server-side request forgery
CVSS 6.3
CVE-2026-4979
MEDIUM
UsersWP <= 1.2.58 - Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter
CVSS 5.0
CVE-2026-40242
HIGH
Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
CVSS 7.2
CVE-2026-40175
MEDIUM
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
CVSS 4.8
CVE-2026-40168
HIGH
Postiz has Server-Side Request Forgery via Redirect Bypass in /api/public/stream
CVSS 8.2
CVE-2026-39922
MEDIUM
GeoNode < 4.4.5, 5.0.2 SSRF via Service Registration
CVSS 6.3
CVE-2026-39921
MEDIUM
GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload
CVSS 6.3
CVE-2026-30232
CRITICAL
Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
CVSS 9.6
CVE-2026-31941
HIGH
Server-Side Request Forgery (SSRF) in Chamilo LMS
CVSS 7.7
CVE-2026-40160
MEDIUM
PraisonAIAgents has SSRF via unvalidated URL in `web_crawl` httpx fallback
CVSS 6.5
CVE-2026-40100
MEDIUM
FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default
CVSS 5.3
CVE-2026-6011
MEDIUM
OpenClaw assertPublicHostname web-fetch.ts server-side request forgery
CVSS 5.6
CVE-2026-40150
HIGH
PraisonAIAgents has SSRF and Local File Read via Unvalidated URLs in web_crawl Tool
CVSS 7.7
CVE-2026-40114
HIGH
PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API
CVSS 7.2
Details
Vulnerabilities
2,681