Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-918 (服务端请求伪造(SSRF)) — Vulnerability Class 1489

1489 vulnerabilities classified as CWE-918 (服务端请求伪造(SSRF)). AI Chinese analysis included.

CVE IDTitleCVSSSeverityPublished
CVE-2026-33766 AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints — AVideo 8.2 -2026-03-27
CVE-2026-4953 mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery — MCMS 7.3 High2026-03-27
CVE-2026-33205 calibre has Server-Side Request Forgery in ebook viewer backend — calibre 8.6 -2026-03-27
CVE-2026-4907 Page-Replica Page Replica Endpoint sitemap sitemap.fetch server-side request forgery — Page Replica 6.3 Medium2026-03-27
CVE-2026-33693 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid() — lemmy 6.5 Medium2026-03-27
CVE-2026-33682 Streamlit on Windows has Unauthenticated SSRF Vulnerability (NTLM Credential Exposure) — streamlit 4.7 Medium2026-03-26
CVE-2026-33619 PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl — pinchtab 4.1 Medium2026-03-26
CVE-2026-33644 Lychee has SSRF bypass via DNS rebinding — PhotoUrlRule only validates IP addresses, not hostnames resolving to internal IPs — Lychee 7.5 -2026-03-26
CVE-2026-3530 OpenID Connect / OAuth client - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-025 — OpenID Connect / OAuth client 9.8AICriticalAI2026-03-26
CVE-2026-33537 Lychee has SSRF bypass via incomplete IP validation in Photo::fromUrl — loopback and link-local IPs not blocked — Lychee 7.1AIHighAI2026-03-26
CVE-2026-32857 Firecrawl Playwright Service SSRF Protection Bypass via Missing Post-Redirect Validation — Firecrawl 8.6 High2026-03-26
CVE-2026-33486 Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents — core-bundle-dev-app 6.8 Medium2026-03-26
CVE-2026-4874 Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation — Red Hat Build of Keycloak 3.1 Low2026-03-26
CVE-2026-33182 Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL — saloon 8.8 -2026-03-26
CVE-2026-1015 IBM InfoSphere Information Server is vulnerable to server-side request forgery — InfoSphere Information Server 5.4 Medium2026-03-25
CVE-2025-14912 IBM InfoSphere Information Server is vulnerable to server-side request forgery — InfoSphere Information Server 5.4 Medium2026-03-25
CVE-2026-1561 IBM WebSphere Application Server Liberty Server-Side Request Forgery — WebSphere Application Server Liberty 5.4 Medium2026-03-25
CVE-2026-24964 WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability — Contest Gallery 6.4 Medium2026-03-25
CVE-2026-3216 Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017 — Drupal Canvas 9.8 -2026-03-25
CVE-2026-33401 Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php — Wallos 8.1 -2026-03-24
CVE-2026-33399 Wallos: SSRF Bypass - Incomplete Fix for CVE-2026-30839/30840 — Wallos 7.7 High2026-03-24
CVE-2026-33407 Wallos: SSRF via HTTP Proxy Environment Variable — Wallos 8.2 -2026-03-24
CVE-2026-33679 Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections — vikunja 6.4 Medium2026-03-24
CVE-2026-33675 Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources — vikunja 6.4 Medium2026-03-24
CVE-2026-4623 DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery — Jeson-Customer-Relationship-Management-System 7.3 High2026-03-24
CVE-2026-32279 Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin — connect-cms 6.8 Medium2026-03-23
CVE-2026-33502 AVideo has Unauthenticated SSRF via plugin/Live/test.php — AVideo 9.3 Critical2026-03-23
CVE-2026-33480 AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy — AVideo 8.6 High2026-03-23
CVE-2026-33351 AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass — AVideo 9.1 Critical2026-03-23
CVE-2026-4589 kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery — kodbox 6.3 Medium2026-03-23

Vulnerabilities classified as CWE-918 (服务端请求伪造(SSRF)) represent 1489 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.