CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
3,003 vulnerabilities with CWE-918
CVE-2026-47390
MEDIUM
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
CVSS 5.5
CVE-2026-15927
MEDIUM
Quay: mirror-registry: ssrf: repo-level mirror accepts external_reference without url validation
CVSS 6.8
CVE-2026-64626
MEDIUM
AVideo Encoder downloadURL SSRF via unpinned retry fallback
CVSS 6.4
CVE-2026-51031
HIGH
FlareSolverr < 3.4.7 - Server-Side Request Forgery via /v1 API Endpoint
CVSS 7.5
CVE-2026-44583
MEDIUM
Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module
CVSS 5.3
CVE-2026-63769
HIGH
Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method
CVSS 7.7
CVE-2026-63731
HIGH
HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint
CVSS 7.7
CVE-2026-63730
MEDIUM
HyperDX < 2.31.0 SSRF via Webhook Test Endpoint
CVSS 5.0
CVE-2026-63107
HIGH
LimeSurvey SSRF via REST API Survey Template Host Header
CVSS 7.7
CVE-2026-60033
MEDIUM
Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0
CVE-2026-45709
MEDIUM
Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer
CVSS 5.8
CVE-2026-62418
HIGH
Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check
CVSS 8.1
CVE-2026-63744
MEDIUM
SurrealDB before 3.1.5 SSRF via JWKS URL Redirect
CVSS 4.1
CVE-2026-63743
MEDIUM
SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect
CVSS 6.4
CVE-2026-63736
MEDIUM
SurrealDB before 3.2.0 SSRF via JWKS URL hostname resolution
CVSS 4.1
CVE-2026-16223
MEDIUM
1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery
CVSS 6.3
CVE-2026-16222
MEDIUM
1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery
CVSS 6.3
CVE-2026-16196
MEDIUM
Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgery
CVSS 6.3
CVE-2026-16194
MEDIUM
zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery
CVSS 6.3
CVE-2026-16128
HIGH
zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery
CVSS 7.3
CVE-2026-16127
HIGH
zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery
CVSS 7.3
CVE-2026-16125
HIGH
zevorn rt-claw http_request net.c claw_net_post server-side request forgery
CVSS 7.3
CVE-2026-16124
MEDIUM
nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery
CVSS 6.3
CVE-2026-16084
HIGH
Sipeed PicoClaw web.go web_fetch server-side request forgery
CVSS 7.3
CVE-2026-54242
MEDIUM
Statamic: Server-Side Request Forgery via Glide (DNS rebinding)
CVSS 4.9
Details
Vulnerabilities
3,003