CWE-918— Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.— MITRE CWE catalog

3,834 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-918page 3 of 77

CVE-2025-54381CRITICALCVSS 9.9EG 9.9
2025-07-29
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote …
CVE-2025-30220CRITICALCVSS 9.9EG 9.9
2025-06-10
GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts wh…
CVE-2025-29972CRITICALCVSS 9.9EG 9.9
2025-05-08
Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network.
CVE-2024-6784CRITICALCVSS 9.9EG 9.9
2024-12-05
Server-Side Request Forgery vulnerabilities were found providing a potential for access to unauthorized resources and unintended information disclosure. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATR…
CVE-2023-3744CRITICALCVSS 9.9EG 9.9
2023-10-02
Server-Side Request Forgery vulnerability in SLims version 9.6.0. This vulnerability could allow an authenticated attacker to send requests to internal services or upload the contents of relevant files via the "scrape_image.php" file in th…
CVE-2023-27586CRITICALCVSS 9.9EG 9.9
2023-03-20
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to version 2.7.0, Cairo can send requests to external hosts when processing SVG files. A malicious actor could send a specially crafted SVG file that allows them to …
CVE-2022-0939CRITICALCVSS 9.9EG 9.9
2022-04-04
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
CVE-2022-0767CRITICALCVSS 9.9EG 9.9
2022-03-07
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.
CVE-2021-33690CRITICALCVSS 9.9EG 9.9
2021-09-15
Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component …
CVE-2017-13667CRITICALCVSS 9.9EG 9.9
2019-05-23
OX Software GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF.
CVE-2025-59503CRITICALCVSS 9.8EG 9.9
2025-10-23
Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.
CVE-2018-1789CRITICALCVSS 8.4EG 9.9
2018-09-07
IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.
CVE-2024-0455CRITICALCVSS 7.5EG 9.9
2024-02-26
The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level (manager, admin, and when in single user) could put in the URL ``` http://169.254.169.254/latest/meta-data/identity-credentials/ec2/se…
CVE-2026-77987CRITICALCVSS 9.8EG 9.8
2026-09-22
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests…
CVE-2026-68536CRITICALCVSS 9.8EG 9.8
2026-09-16
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.
CVE-2025-56563CRITICALCVSS 9.8EG 9.8
2026-09-16
A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validatio…
CVE-2026-87595CRITICALCVSS 9.8EG 9.8
2026-09-09
Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-78003CRITICALCVSS 9.8EG 9.8
2026-08-22
The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which acc…
CVE-2026-34884CRITICALCVSS 9.8EG 9.8
2026-08-18
SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP. This issue affects Apache SkyWalking MCP: 0.1.0. Users are recommended to upgrade to version 0.2.0, which fixes this issue.
CVE-2026-50775CRITICALCVSS 9.8EG 9.8
2026-08-17
A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails to return the content or any errors directly.
CVE-2026-13739CRITICALCVSS 9.8EG 9.8
2026-08-11
A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Comman…
CVE-2026-15732CRITICALCVSS 9.8EG 9.8
2026-08-06
A Server-Side Request Forgery (SSFR) vulnerability exist in WGDashboard version 4.2.3 and earlier. The webhook functionality allows authenticated attackers to make arbitrary HTTP requests and retrieve responses.
CVE-2026-17617CRITICALCVSS 9.8EG 9.8
2026-08-05
IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in custom resources.
CVE-2026-64873CRITICALCVSS 9.8EG 9.8
2026-07-23
Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services.
CVE-2026-11714CRITICALCVSS 9.8EG 9.8
2026-06-30
IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
CVE-2026-11546CRITICALCVSS 9.8EG 9.8
2026-06-30
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
CVE-2026-30118CRITICALCVSS 9.8EG 9.8
2026-05-19
scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar_url query parameter of the Scalar Proxy endpoint. This vulnerability allows unauthenticated attackers to force the backend server to send HTT…
CVE-2026-43995CRITICALCVSS 9.8EG 9.8
2026-05-11
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. Th…
CVE-2026-44335CRITICALCVSS 9.8EG 9.8
2026-05-08
PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. This issue has been patched in version 1.6.32.
CVE-2026-8034CRITICALCVSS 9.8EG 9.8
2026-05-07
A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the …
CVE-2026-34084CRITICALCVSS 9.8EG 9.8
2026-05-05
PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename argument to IOFactory::load(…
CVE-2026-5936CRITICALCVSS 9.8EG 9.8
2026-04-13
An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services, access otherwise unreachab…
CVE-2026-32186CRITICALCVSS 9.8EG 9.8
2026-04-03
Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-4789CRITICALCVSS 9.8EG 9.8
2026-03-30
Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.
CVE-2026-2286CRITICALCVSS 9.8EG 9.8
2026-03-30
CrewAI contains a server-side request forgery vulnerability that enables content acquisition from internal and cloud services, facilitated by the RAG search tools not properly validating URLs provided at runtime.
CVE-2026-25960CRITICALCVSS 9.8EG 9.8
2026-03-09
vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method due to inconsistent URL parsing behavior between the valid…
CVE-2025-70042CRITICALCVSS 9.8EG 9.8
2026-03-09
An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master.
CVE-2026-26222CRITICALCVSS 9.8EG 9.8
2026-02-24
Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP and HTTP/SOAP via Altec.RDCHostService.exe using the ObjectURI "doclinkServer.soap". The service does not require auth…
CVE-2026-26339CRITICALCVSS 9.8EG 9.8
2026-02-19
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.
CVE-2026-26338CRITICALCVSS 9.8EG 9.8
2026-02-19
Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery (SSRF) through the document processing functionality.
CVE-2026-2654CRITICALCVSS 9.8EG 9.8
2026-02-18
A weakness has been identified in huggingface smolagents 1.24.0. Impacted is the function requests.get/requests.post of the component LocalPythonExecutor. Executing a manipulation can lead to server-side request forgery. It is possible to …
CVE-2026-2532CRITICALCVSS 9.8EG 9.8
2026-02-16
A vulnerability was detected in lintsinghua DeepAudit up to 3.0.3. This issue affects some unknown processing of the file backend/app/api/v1/endpoints/embedding_config.py of the component IP Address Handler. Performing a manipulation resul…
CVE-2025-11242CRITICALCVSS 9.8EG 9.8
2026-02-10
Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik allows Server Side Request Forgery. This issue affects Okulistik: through 21102025.
CVE-2025-62616CRITICALCVSS 9.8EG 9.8
2026-02-04
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.34, in SendDiscordFileBlock, the third-party library aioht…
CVE-2025-62615CRITICALCVSS 9.8EG 9.8
2026-02-04
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.34, in RSSFeedBlock, the third-party library urllib.reques…
CVE-2026-1062CRITICALCVSS 9.8EG 9.8
2026-01-17
A flaw has been found in xiweicheng TMS up to 2.28.0. This affects the function Summary of the file src/main/java/com/lhjz/portal/util/HtmlUtil.java. This manipulation of the argument url causes server-side request forgery. It is possible …
CVE-2023-53899CRITICALCVSS 9.8EG 9.8
2025-12-16
PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter to trigger external HTTP requests to arbit…
CVE-2025-66405CRITICALCVSS 9.8EG 9.8
2025-12-01
Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the value in the x-portkey-custom-host request header. The proxy route then appends…
CVE-2025-13814CRITICALCVSS 9.8EG 9.8
2025-12-01
A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. Impacted is the function LocalFileServiceImpl.uploadPictureByUrl of the file /file/uploadPicsByUrl. The manipulation results in server-side request forgery. The atta…
CVE-2025-62207CRITICALCVSS 9.8EG 9.8
2025-11-20
Azure Monitor Elevation of Privilege Vulnerability

Map vulnerabilities like CWE-918 to your infrastructure

EchelonGraph correlates every CVE — across CWE-918 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →