CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
2,681 vulnerabilities with CWE-918
CVE-2026-32186
CRITICAL
Microsoft Bing Elevation of Privilege Vulnerability
CVSS 10.0
CVE-2026-5470
MEDIUM
mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery
CVSS 6.3
CVE-2026-31818
CRITICAL
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
CVSS 9.6
CVE-2026-5469
MEDIUM
Casdoor Webhook URL server-side request forgery
CVSS 4.7
CVE-2026-33107
CRITICAL
Azure Databricks Elevation of Privilege Vulnerability
CVSS 10.0
CVE-2026-26135
CRITICAL
Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability
CVSS 9.6
CVE-2026-5418
HIGH
appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery
CVSS 7.3
CVE-2026-5417
MEDIUM
Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery
CVSS 4.7
CVE-2026-34590
MEDIUM
Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
CVSS 5.4
CVE-2026-34577
HIGH
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
CVSS 8.6
CVE-2026-34576
HIGH
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
CVSS 7.7
CVE-2026-34526
MEDIUM
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
CVSS 5.0
CVE-2026-5346
HIGH
huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery
CVSS 7.3
CVE-2026-32871
CRITICAL
FastMCP <3.2.0 OpenAPIProvider - Server-Side Request Forgery
CVSS 10.0
CVE-2026-0688
MEDIUM
Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery
CVSS 6.4
CVE-2026-0686
HIGH
Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery
CVSS 7.2
CVE-2026-5323
MEDIUM
priyankark a11y-mcp index.js A11yServer server-side request forgery
CVSS 5.3
CVE-2026-34515
HIGH
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
CVSS 7.5
CVE-2026-34746
HIGH
Payload has Authenticated SSRF via Upload Functionality
CVSS 7.7
CVE-2026-34076
HIGH
Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
CVSS 7.4
CVE-2026-33990
CRITICAL
Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)
CVSS 9.1
CVE-2026-20041
MEDIUM
Cisco Nexus Dashboard Server Side Request Forgery Vulnerability
CVSS 6.1
CVE-2026-4989
MEDIUM
Devolutions Server 2025.3.1-2025.3.17 & 2026.1.1-2026.1.11 SSRF via Gateway Health Check API
CVSS 4.3
CVE-2026-0932
HIGH
M-Files Server < 26.3 - Unauthenticated Blind Server-Side Request Forgery via Legacy Co-Authoring Connection
CVSS 7.3
CVE-2026-5259
MEDIUM
AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery
CVSS 6.3
Details
Vulnerabilities
2,681