CWE-918

Server-Side Request Forgery (SSRF)

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

3,003 vulnerabilities with CWE-918
CVE-2026-15619 MEDIUM
mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery
CVSS 6.3
CVE-2026-62242 HIGH
Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration
CVSS 8.6
CVE-2026-62240 HIGH
CrewAI < 1.15.1 SSRF Filter Bypass via HTTP Redirect in Scrape Tools
CVSS 7.4
CVE-2026-62197 HIGH
OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery
CVSS 8.5
CVE-2026-49969 HIGH
Laravel-Mediable < 7.0.0 SSRF via RemoteUrlAdapter URL Handling
CVSS 7.4
CVE-2026-61970 MEDIUM
WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability
CVSS 4.9
CVE-2026-57413 MEDIUM
WordPress Instant Image Generator plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability
CVSS 6.4
CVE-2026-57407 HIGH
WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability
CVSS 7.2
CVE-2026-57372 HIGH
WordPress WPJAM Basic plugin <= 7.0 - Server Side Request Forgery (SSRF) vulnerability
CVSS 7.2
CVE-2026-49876 MEDIUM
Apache Gravitino <= 1.2.1 - Authenticated Server-Side Request Forgery
CVSS 6.5
CVE-2026-62143 HIGH
Server-Side Request Forgery protection bypass in misp-modules html_to_markdown via IPv4-mapped IPv6 addresses
CVE-2026-15525 MEDIUM
kLOsk adloop write.py _validate_urls server-side request forgery
CVSS 6.3
CVE-2026-15508 MEDIUM
Helicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgery
CVSS 6.3
CVE-2026-15501 MEDIUM
AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery
CVSS 6.3
CVE-2026-15500 MEDIUM
AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery
CVSS 6.3
CVE-2026-61429 HIGH
PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend
CVSS 8.5
CVE-2026-55807 LOW
Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008
CVSS 3.1
CVE-2026-55187 MEDIUM
Mailpit Link Check API < 1.30.2 - IPv6 Transition Server-Side Request Forgery
CVSS 5.8
CVE-2026-49213 HIGH
TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution
CVSS 8.1
CVE-2026-13233 LOW
OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053
CVSS 3.3
CVE-2026-57575 MEDIUM
Misskey: SSRF bypass in URL Preview
CVE-2026-57211 MEDIUM
RabbitMQ: UNC SSRF affecting the management UI on Windows
CVSS 6.5
CVE-2026-55229 HIGH
Gotenberg: SSRF via LibreOffice document processing
CVSS 7.5
CVE-2026-53450 HIGH
Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
CVSS 7.4
CVE-2026-55671 LOW
ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components
Details
Vulnerabilities 3,003
Links
MITRE CWE Entry Search this CWE With Exploits