Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-918 (服务端请求伪造(SSRF)) — Vulnerability Class 1489

1489 vulnerabilities classified as CWE-918 (服务端请求伪造(SSRF)). AI Chinese analysis included.

CVE IDTitleCVSSSeverityPublished
CVE-2026-39974 n8n-MCP has an Authenticated SSRF via instance-URL header in multi-tenant HTTP mode — n8n-mcp 8.5 High2026-04-09
CVE-2026-39843 Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching — plane 7.7 High2026-04-09
CVE-2026-5832 atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgery — api-lab-mcp 7.3 High2026-04-09
CVE-2026-39885 FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications — frontmcp 7.5 High2026-04-08
CVE-2026-5803 bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgery — openai-realtime-ui 6.3 Medium2026-04-08
CVE-2026-39362 InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs — InvenTree 7.1AIHighAI2026-04-08
CVE-2026-34719 Zammad has a Server-side request forgery (SSRF) via webhooks — zammad 6.5AIMediumAI2026-04-08
CVE-2026-32591 Mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration — mirror registry for Red Hat OpenShift 5.2 Medium2026-04-08
CVE-2026-33458 Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure — Kibana 6.8 Medium2026-04-08
CVE-2026-2377 Mirror-registry: quay: quay: server-side request forgery via log export functionality — mirror registry for Red Hat OpenShift 6.5 Medium2026-04-08
CVE-2026-39695 WordPress Podigee plugin <= 1.4.0 - Server Side Request Forgery (SSRF) vulnerability — Podigee 9.1AICriticalAI2026-04-08
CVE-2026-39670 WordPress Visual Link Preview plugin <= 2.3.0 - Server Side Request Forgery (SSRF) vulnerability — Visual Link Preview 9.1AICriticalAI2026-04-08
CVE-2026-39645 WordPress GlobalPayments WooCommerce plugin <= 1.18.0 - Server Side Request Forgery (SSRF) vulnerability — GlobalPayments WooCommerce 9.8AICriticalAI2026-04-08
CVE-2026-39647 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.11 - Server Side Request Forgery (SSRF) vulnerability — MP3 Audio Player for Music, Radio & Podcast by Sonaar 9.1AICriticalAI2026-04-08
CVE-2026-39630 WordPress Getty Images plugin <= 4.1.0 - Server Side Request Forgery (SSRF) vulnerability — Getty Images 7.5AIHighAI2026-04-08
CVE-2026-39521 WordPress Nelio Content plugin <= 4.3.1 - Server Side Request Forgery (SSRF) vulnerability — Nelio Content 9.1AICriticalAI2026-04-08
CVE-2026-39464 WordPress Coming Soon Page, Under Construction & Maintenance Mode by SeedProd plugin <= 6.19.8 - Server Side Request Forgery (SSRF) vulnerability — Coming Soon Page, Under Construction & Maintenance Mode by SeedProd 9.8AICriticalAI2026-04-08
CVE-2026-1343 Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access — Verify Identity Access Container 7.2 High2026-04-08
CVE-2026-39370 WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732) — AVideo 7.1 High2026-04-07
CVE-2026-39368 WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services — AVideo 6.5 Medium2026-04-07
CVE-2026-39361 OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url — openobserve 7.7 High2026-04-07
CVE-2026-35572 SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts — CRM 7.1AIHighAI2026-04-07
CVE-2026-35516 LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection — LinkAce 5.0 Medium2026-04-07
CVE-2026-35486 text-generation-webui has a SSRF in superbooga/superboogav2 extensions — no URL validation — text-generation-webui 7.5 High2026-04-07
CVE-2026-35461 Papra has a Blind Server-Side Request Forgery (SSRF) via Webhook URL — papra 5.0 Medium2026-04-07
CVE-2026-35409 Directus has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import — directus 7.7 High2026-04-06
CVE-2026-35459 pyLoad has SSRF fix bypass via HTTP redirect — pyload 4.6AIMediumAI2026-04-06
CVE-2026-35187 pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter — pyload 7.7 High2026-04-06
CVE-2026-35037 Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata — Ech0 7.2 High2026-04-06
CVE-2026-35036 Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature — Ech0 7.5 High2026-04-06

Vulnerabilities classified as CWE-918 (服务端请求伪造(SSRF)) represent 1489 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.