CWE-918

Server-Side Request Forgery (SSRF)

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

2,681 vulnerabilities with CWE-918
CVE-2026-32186 CRITICAL
Microsoft Bing Elevation of Privilege Vulnerability
CVSS 10.0
CVE-2026-5470 MEDIUM
mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery
CVSS 6.3
CVE-2026-31818 CRITICAL
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
CVSS 9.6
CVE-2026-5469 MEDIUM
Casdoor Webhook URL server-side request forgery
CVSS 4.7
CVE-2026-33107 CRITICAL
Azure Databricks Elevation of Privilege Vulnerability
CVSS 10.0
CVE-2026-26135 CRITICAL
Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability
CVSS 9.6
CVE-2026-5418 HIGH
appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery
CVSS 7.3
CVE-2026-5417 MEDIUM
Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery
CVSS 4.7
CVE-2026-34590 MEDIUM
Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
CVSS 5.4
CVE-2026-34577 HIGH
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
CVSS 8.6
CVE-2026-34576 HIGH
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
CVSS 7.7
CVE-2026-34526 MEDIUM
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
CVSS 5.0
CVE-2026-5346 HIGH
huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery
CVSS 7.3
CVE-2026-32871 CRITICAL
FastMCP <3.2.0 OpenAPIProvider - Server-Side Request Forgery
CVSS 10.0
CVE-2026-0688 MEDIUM
Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery
CVSS 6.4
CVE-2026-0686 HIGH
Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery
CVSS 7.2
CVE-2026-5323 MEDIUM
priyankark a11y-mcp index.js A11yServer server-side request forgery
CVSS 5.3
CVE-2026-34515 HIGH
AIOHTTP: UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows
CVSS 7.5
CVE-2026-34746 HIGH
Payload has Authenticated SSRF via Upload Functionality
CVSS 7.7
CVE-2026-34076 HIGH
Clerk JavaScript: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host
CVSS 7.4
CVE-2026-33990 CRITICAL
Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)
CVSS 9.1
CVE-2026-20041 MEDIUM
Cisco Nexus Dashboard Server Side Request Forgery Vulnerability
CVSS 6.1
CVE-2026-4989 MEDIUM
Devolutions Server 2025.3.1-2025.3.17 & 2026.1.1-2026.1.11 SSRF via Gateway Health Check API
CVSS 4.3
CVE-2026-0932 HIGH
M-Files Server < 26.3 - Unauthenticated Blind Server-Side Request Forgery via Legacy Co-Authoring Connection
CVSS 7.3
CVE-2026-5259 MEDIUM
AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery
CVSS 6.3
Details
Vulnerabilities 2,681