CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
2,441 vulnerabilities with CWE-918
CVE-2026-33540
HIGH
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
CVSS 7.5
CVE-2026-5633
HIGH
assafelovic gpt-researcher ws Endpoint server-side request forgery
CVSS 7.3
CVE-2026-5623
MEDIUM
hcengineering Huly Platform Import Endpoint index.ts server-side request forgery
CVSS 6.3
CVE-2026-5618
MEDIUM
kalcaddle kodbox shareMake/shareCheck server-side request forgery
CVSS 5.6
CVE-2026-5607
MEDIUM
imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery
CVSS 6.3
CVE-2026-5538
MEDIUM
QingdaoU OnlineJudge judge_server_heartbeat Endpoint JudgeServer.service_url server-side request forgery
CVSS 6.3
CVE-2026-5530
MEDIUM
Ollama Model Pull API download.go server-side request forgery
CVSS 6.3
CVE-2026-34954
HIGH
PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL
CVSS 8.6
CVE-2026-34936
HIGH
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
CVSS 7.7
CVE-2026-22664
HIGH
prompts.chat SSRF via Fal.ai Media Status Polling
CVSS 7.7
CVE-2026-22662
MEDIUM
prompts.chat Blind SSRF via media-generate
CVSS 4.3
CVE-2026-28798
CRITICAL
Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS
CVSS 9.0
CVE-2026-32186
CRITICAL
Microsoft Bing Elevation of Privilege Vulnerability
CVSS 10.0
CVE-2026-5470
MEDIUM
mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery
CVSS 6.3
CVE-2026-31818
CRITICAL
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
CVSS 9.6
CVE-2026-5469
MEDIUM
Casdoor Webhook URL server-side request forgery
CVSS 4.7
CVE-2026-33107
CRITICAL
Azure Databricks Elevation of Privilege Vulnerability
CVSS 10.0
CVE-2026-26135
CRITICAL
Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability
CVSS 9.6
CVE-2026-5418
HIGH
appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery
CVSS 7.3
CVE-2026-5417
MEDIUM
Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery
CVSS 4.7
CVE-2026-34590
MEDIUM
Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
CVSS 5.4
CVE-2026-34577
HIGH
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
CVSS 8.6
CVE-2026-34576
HIGH
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
CVSS 7.7
CVE-2026-34526
MEDIUM
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
CVSS 5.0
CVE-2026-5346
HIGH
huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery
CVSS 7.3
Details
Vulnerabilities
2,441