CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
3,006 vulnerabilities with CWE-918
CVE-2026-42147
MEDIUM
Coolify: SSRF via S3 Storage Endpoint in testConnection()
CVSS 4.9
CVE-2026-34170
MEDIUM
Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL
CVSS 4.3
CVE-2026-57573
HIGH
Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint
CVSS 8.6
CVE-2026-58404
MEDIUM
Hugo security.http.urls deny rules bypassed by alternate IPv4 encodings
CVSS 6.8
CVE-2026-50134
MEDIUM
Hugo: security.http.urls allow-list bypass via HTTP redirects
CVSS 5.8
CVE-2026-44937
HIGH
SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components
CVSS 8.2
CVE-2026-44936
MEDIUM
Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml
CVSS 5.0
CVE-2026-55994
HIGH
Apache Camel Iggy - Server-Side Request Forgery via Iggy User Headers
CVSS 7.5
CVE-2026-55993
HIGH
Apache Camel Atmosphere Websocket - Server-Side Request Forgery via Query Parameters
CVSS 7.5
CVE-2026-48205
CRITICAL
Apache Camel DNS - Server-Side Request Forgery via DNS Headers
CVSS 9.1
CVE-2026-48203
CRITICAL
Apache Camel Solr - Server-Side Request Forgery via SolrParam Headers
CVSS 9.1
CVE-2026-46726
HIGH
Apache Camel Vertx Websocket - Server-Side Request Forgery via Query Parameters
CVSS 7.5
CVE-2026-14748
MEDIUM
AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery
CVSS 6.3
CVE-2026-58418
MEDIUM
Gitea Open Source Git Server - SSRF via HTTP Redirect in Repository Migration
CVSS 6.5
CVE-2026-58278
MEDIUM
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS 5.4
CVE-2026-57993
HIGH
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS 7.4
CVE-2026-57987
MEDIUM
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS 6.5
CVE-2026-22874
CRITICAL
Gitea webhook and migration allow-list filtering permits SSRF
CVSS 9.6
CVE-2026-10055
HIGH
Eclipse Theia < 1.73.0 - Exposure of Sensitive Information to an Unauthorized Actor
CVSS 8.5
CVE-2026-11397
MEDIUM
WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter
CVSS 5.5
CVE-2026-57100
CRITICAL
Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
CVSS 9.9
CVE-2026-45499
CRITICAL
Microsoft Azure Open AI - Azure OpenAI Elevation of Privilege Vulnerability
CVSS 9.9
CVE-2026-59101
MEDIUM
AutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloader
CVSS 5.8
CVE-2026-59095
HIGH
LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl
CVSS 7.7
CVE-2026-55115
CRITICAL
Ubiquiti INC UniFi Protect Application < 7.1.83 - Server-Side Request Forgery (SSRF)
CVSS 9.9
Details
Vulnerabilities
3,006