CWE-918

Server-Side Request Forgery (SSRF)

Parent: CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

2,441 vulnerabilities with CWE-918
CVE-2026-33540 HIGH
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
CVSS 7.5
CVE-2026-5633 HIGH
assafelovic gpt-researcher ws Endpoint server-side request forgery
CVSS 7.3
CVE-2026-5623 MEDIUM
hcengineering Huly Platform Import Endpoint index.ts server-side request forgery
CVSS 6.3
CVE-2026-5618 MEDIUM
kalcaddle kodbox shareMake/shareCheck server-side request forgery
CVSS 5.6
CVE-2026-5607 MEDIUM
imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery
CVSS 6.3
CVE-2026-5538 MEDIUM
QingdaoU OnlineJudge judge_server_heartbeat Endpoint JudgeServer.service_url server-side request forgery
CVSS 6.3
CVE-2026-5530 MEDIUM
Ollama Model Pull API download.go server-side request forgery
CVSS 6.3
CVE-2026-34954 HIGH
PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL
CVSS 8.6
CVE-2026-34936 HIGH
PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback
CVSS 7.7
CVE-2026-22664 HIGH
prompts.chat SSRF via Fal.ai Media Status Polling
CVSS 7.7
CVE-2026-22662 MEDIUM
prompts.chat Blind SSRF via media-generate
CVSS 4.3
CVE-2026-28798 CRITICAL
Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS
CVSS 9.0
CVE-2026-32186 CRITICAL
Microsoft Bing Elevation of Privilege Vulnerability
CVSS 10.0
CVE-2026-5470 MEDIUM
mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery
CVSS 6.3
CVE-2026-31818 CRITICAL
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist
CVSS 9.6
CVE-2026-5469 MEDIUM
Casdoor Webhook URL server-side request forgery
CVSS 4.7
CVE-2026-33107 CRITICAL
Azure Databricks Elevation of Privilege Vulnerability
CVSS 10.0
CVE-2026-26135 CRITICAL
Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability
CVSS 9.6
CVE-2026-5418 HIGH
appsmithorg appsmith Dashboard WebClientUtils.java computeDisallowedHosts server-side request forgery
CVSS 7.3
CVE-2026-5417 MEDIUM
Dataease SQLbot Elasticsearch es_engine.py get_es_data_by_http server-side request forgery
CVSS 4.7
CVE-2026-34590 MEDIUM
Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
CVSS 5.4
CVE-2026-34577 HIGH
Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check
CVSS 8.6
CVE-2026-34576 HIGH
Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata
CVSS 7.7
CVE-2026-34526 MEDIUM
SillyTavern: Incomplete IP validation in /api/search/visit allows SSRF via localhost and IPv6
CVSS 5.0
CVE-2026-5346 HIGH
huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery
CVSS 7.3
Details
Vulnerabilities 2,441