On this page
CWE-918: Server-Side Request Forgery (SSRF)
Weakness Summary
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
- Canonical source: MITRE CWE-918 (opens in a new tab)
- Published Atomicorp CVE observations: 667
- Distinct affected products in those observations: 467
- Active Atomicorp rules associated with this weakness: 94
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2019-16932 | Visualizer <3.3.1 - Blind Server-Side Request Forgery | visualizer | Protected by Atomicorp rules | 344362 |
| CVE-2026-33712 | TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls | typebot.io | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-40114 | PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API | praisonai | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-49869 | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in AuthenticationFilter | kestra | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-54745 | Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENAB | pipelines | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-83548 | SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution | sma8200v | Protected by Atomicorp rules | 330925 |
| CVE-2021-33690 | SAP NetWeaver Development Infrastructure - Server Side Request Forgery | netweaver development infrastructure | Protected by Atomicorp rules | 340162 , 340163 |
| CVE-2025-64709 | Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block | typebot | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-31818 | Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist | budibase | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-40089 | Sonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API client | radio audio streaming stack | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-42864 | FireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theft | firefighter-incident | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-43986 | Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay | Tautulli | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44015 | Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services | nginx ui | Protected by Atomicorp rules | 390719 |
| CVE-2026-55166 | Lemur: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and cr | lemur | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2013-4864 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | Protected by Atomicorp rules | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2018-14728 | Responsive filemanager 9.13.1 Server-Side Request Forgery | responsive filemanager | Protected by Atomicorp rules | 392301 |
| CVE-2020-24881 | OsTicket < 1.14.3 - Server Side Request Forgery | osticket | Protected by Atomicorp rules | 340147 , 340148 |
| CVE-2021-21985 | VMware vCenter Server Virtual SAN Health Check Plugin RCE | vcenter server | Protected by Atomicorp rules | 340162 , 340163 |
| CVE-2021-22175 | GitLab CI Lint API - Server-Side Request Forgery | gitlab | Protected by Atomicorp rules | 344362 , 344370 |
| CVE-2021-22986 | F5 iControl REST Unauthenticated SSRF Token Generation RCE | big-ip access policy manager | Protected by Atomicorp rules | 330791 , 337109 , 337110 , 340152 , 344363 , 344370 , 392767 , 393655 , 398021 , 398022 |
| CVE-2021-24472 | Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery | kentharadio | Protected by Atomicorp rules | 340162 , 340163 |
| CVE-2021-32682 | elFinder ZIP Arguments Injection Leads to Commands Injection (CVE-2021-32682) | elfinder | Protected by Atomicorp rules | 340007 , 344360 , 344361 , 344363 , 344364 , 344370 , 347009 , 393655 , 393781 |
| CVE-2022-31188 | CVAT 2.0 - Server Side Request Forgery | computer vision annotation tool | Detected by Atomicorp rules | 345493 |
| CVE-2022-38580 | X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) | skipper | Protected by Atomicorp rules | 337110 , 390727 , 392301 , 392648 , 398022 |
| CVE-2023-43654 | PyTorch Model Server Registration and Deserialization RCE | torchserve | Protected by Atomicorp rules | 337109 , 337110 , 398021 , 398022 |
| CVE-2023-48022 | Anyscale Ray - Remote Code Execution | ray | Protected by Atomicorp rules | 392301 , 392648 |
| CVE-2024-45507 | Apache OFBiz SSRF and Remote Code Execution (CVE-2024-45507) | ofbiz | Protected by Atomicorp rules | 340162 , 340163 , 344370 |
| CVE-2025-56563 | Server-Side Request Forgery | - | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15732 | WGDashboard Server-Side Request Forgery Vulnerability | WGDashboard | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-30118 | scalar/astro v0.1.13 was discovered to Server-Side Request Forgery Vulnerability | - | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2019-8982 | Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery | wavemarker studio | Protected by Atomicorp rules | 344360 , 347009 |
| CVE-2026-12564 | Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credenti | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-12605 | glassfish Server-Side Request Forgery Vulnerability | glassfish | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-13751 | Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load | snowflake cli | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-53513 | Better Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration | better-auth/sso | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-61559 | @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery | gitlab-mcp | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2020-36851 | Rob–W cors-anywhere Misconfigured CORS Proxy Allows SSRF | Rob–W / cors-anywhere | Protected by Atomicorp rules | 390719 , 398021 , 398022 , 398023 |
| CVE-2026-42596 | Gotenberg < 8.31.0 - Server-Side Request Forgery | gotenberg | Protected by Atomicorp rules | 344362 , 398004 |
| CVE-2026-62668 | Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols | grav | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-86123 | SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints | sqlchat | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2023-7325 | Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF | Mingyu Operations and Maintenance Audit and Risk Control System | Protected by Atomicorp rules | 390719 , 390723 |
| CVE-2024-28752 | Apache CXF Aegis DataBinding Server-Side Request Forgery (CVE-2024-28752) | cxf | Protected by Atomicorp rules | 391213 |
| CVE-2026-64849 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirect | mlflow | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-66794 | Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route | multicluster engine for Kubernetes 2.10 | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-67426 | Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration | flyto-core | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-75885 | Openshift/console: openshift/console: unauthenticated ssrf and resource exhaustion via devfile parser endpoint | Red Hat OpenShift Container Platform 4.12 | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-109238 | Crawl4AI 0.7.0 before 0.9.4 SSRF via link_preview_config URL Seeder | crawl4ai | Protected by Atomicorp rules | 337109 , 337110 , 341245 , 344360 , 398021 , 398022 |
| CVE-2026-110628 | Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment | kan | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-111663 | Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation | chaskiq | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114493 | LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects | LocalAI | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-42281 | MagicMirror <= 2.35.0 - Server-Side Request Forgery | magicmirror | Detected by Atomicorp rules | 398001 |
| CVE-2026-56266 | Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints | crawl4ai | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-59707 | LocalAI - Server-Side Request Forgery via POST /models/apply | LocalAI | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-63306 | stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints | stoatchat | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-65057 | Keep Unauthenticated Server-Side Request Forgery via POST /providers/healthcheck | keep | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-65317 | Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass | Verba | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-65318 | Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader | Verba | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-85614 | OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker | openpanel | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-86119 | Webstudio through 0.296.0 SSRF via /cgi proxy routes | webstudio | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-92576 | HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool | nanobot | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2017-14611 | Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery | cockpit | Protected by Atomicorp rules | 390727 , 392301 , 392648 |
| CVE-2018-9302 | Cockpit CMS 0.4.4 < 0.5.5 - Server-Side Request Forgery | cockpit | Protected by Atomicorp rules | 390727 , 392301 , 392648 |
| CVE-2021-26855 | Microsoft Exchange ProxyLogon RCE | exchange server | Protected by Atomicorp rules | 330791 , 340014 , 340147 , 340148 , 340152 , 340193 , 341256 , 342259 , 344363 , 346755 , 390716 |
| CVE-2021-34473 | Microsoft Exchange ProxyShell RCE | exchange server | Protected by Atomicorp rules | 340095 , 344365 , 344366 , 390716 |
| CVE-2026-107781 | Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById | skyeye | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-17552 | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concaten | Plack::App::Prerender | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-44313 | LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function | linkwarden | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-51152 | Server-Side Request Forgery | - | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-62308 | Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint | tugtainer | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-75332 | Zyplayer-Doc <=1.0.0 Server-Side Request Forgery Vulnerability | - | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2021-40438 | Apache HTTP Server 2.4.48 mod_proxy SSRF (CVE-2021-40438) | rocky linux | Protected by Atomicorp rules | 345271 , 390723 |
| CVE-2026-13603 | SSRF with API key leak in pretix-oppwa | pretix-oppwa | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54157 | LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery | lobe-chat | Protected by Atomicorp rules | 392301 |
| CVE-2026-86259 | OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation | OpenMAIC | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-115729 | @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass | common | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-50189 | Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route | appsmith | Protected by Atomicorp rules | 390719 |
| CVE-2026-82866 | @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch | common | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2023-39108 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | Protected by Atomicorp rules | 340162 , 340165 , 344360 , 347009 |
| CVE-2023-39109 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | Protected by Atomicorp rules | 340162 , 340165 , 344360 , 347009 |
| CVE-2023-39110 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | Protected by Atomicorp rules | 340165 , 344360 , 347009 |
| CVE-2026-100391 | MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation | mediaflow-proxy | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104464 | YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-116176 | vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector | vllm | Protected by Atomicorp rules | 390719 |
| CVE-2026-57143 | PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url paramete | praisonaiagents | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-62857 | Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources | fedify | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92566 | DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview | datagear | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2020-37278 | Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile | e-Bridge | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2023-54402 | iDocView SSRF via /doc/upload Endpoint Hardcoded Token | iDocView | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-34350 | UnForm Server < 10.1.15 Doc Flow Unauthenticated File Read | UnForm Server | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-33226 | Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview | budibase | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34367 | InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | Protected by Atomicorp rules | 337109 , 337110 , 340147 , 340162 , 340163 , 340165 , 344360 , 344370 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-47659 | Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename} | pathling | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-55245 | Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL | bifrost | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-81093 | Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton | actors-mcp-server | Detected by Atomicorp rules | 340162 , 340165 , 347009 , 390722 |
| CVE-2026-82270 | Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/* | gateway | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390719 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82638 | jina-ai reader Server-Side Request Forgery via disabled private-address guard | reader | Detected by Atomicorp rules | 344360 , 347009 , 390719 , 390722 , 398001 , 398021 |
| CVE-2026-85608 | Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter | Douyin TikTok Download API | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85612 | OpenPanel before 2.3.0 SSRF via favicon and og endpoints | openpanel | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85666 | ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url | ogx | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85673 | LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding | LlamaFactory | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85691 | MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url | megaparse | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-91935 | Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes | Flowise | Protected by Atomicorp rules | 310047 , 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-92719 | Quickwit through 0.9.0 SSRF via SQS queue_url Parameter | quickwit | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92815 | changedetection.io through 0.60.6 SSRF via browser-step Goto URL | changedetection.io | Protected by Atomicorp rules | 337109 , 337110 , 340163 , 344360 , 398021 , 398022 |
| CVE-2021-22214 | Gitlab CE/EE 10.5 - Server-Side Request Forgery | gitlab | Protected by Atomicorp rules | 344362 |
| CVE-2022-41412 | perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery | perfsonar | Protected by Atomicorp rules | 340007 |
| CVE-2026-34160 | Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata ser | chamilo lms | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34577 | Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check | postiz | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-35032 | Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner | jellyfin | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-45298 | Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy) | dozzle | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-56677 | 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint | 9router | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-57573 | Crawl4AI unauthenticated SSRF in Docker streaming crawl endpoint | crawl4ai | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-7412 | Eclipse BaSyx SSRF Vulnerability | Eclipse BaSyx | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2026-77581 | BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass | bentopdf | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-81213 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | langflow | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-81889 | elFinder: SSRF protection bypass via DNS rebinding in the fsock_get_contents() fallback | elFinder | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-10055 | Eclipse Theia Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | Eclipse Theia | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-31943 | LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP | librechat | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-42860 | Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint | edx-enterprise | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-46372 | SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl | SillyTavern | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-51583 | usememos through v0.30.0 Server-Side Request Forgery Vulnerability | - | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-56663 | AutoGPT: SSRF-to-RCE Chain in SendWebRequestBlock via IP validation bypass and internal pg-meta access | AutoGPT | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56739 | Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint | logto | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 344362 , 344370 , 398021 , 398022 |
| CVE-2026-57126 | praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS | PraisonAI | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-57894 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfil | Gitea Open Source Git Server | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-61640 | Wallos: SSRF via OIDC Token/UserInfo URL Configuration | Wallos | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-67424 | Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation | flyto-core | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-67428 | Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF | flyto-core | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-68558 | Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) | wekan | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-76086 | Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials | formie | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-110255 | Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint | dockhand | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54507 | Vvveb oEmbedProxy vulnerable to server-side request forgery | Vvveb | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-57862 | Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation | Kanboard | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-61429 | PraisonAI before 1.6.78 SSRF via Crawl4AI Chromium backend | PraisonAI | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-61430 | PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl | PraisonAI | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-62234 | Grav < 2.0.4 SSRF via Unrestricted cURL Protocols | grav | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-72855 | Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST | server | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-73629 | Serendipity before 2.6.0 SSRF via hex IPv4 and IPv6 addresses | Serendipity | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-75898 | RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component | ragflow | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2012-10018 | WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload | mapplic | Protected by Atomicorp rules | 346755 , 377360 |
| CVE-2026-103757 | Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation | budibase | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-104458 | YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390719 , 390722 , 398021 , 398022 |
| CVE-2026-104463 | YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-105762 | Dify: Unauthenticated Server-Side Request Forgery in /console/api/remote-files/upload endpoint | dify | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-22219 | Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element | chainlit | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-22681 | OpenViking < 0.3.4 SSRF via /api/v1/resources | OpenViking | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34428 | Vvveb < 1.0.8.1 SSRF via oEmbedProxy | Vvveb | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34576 | Postiz: SSRF in upload-from-url endpoint allows fetching internal resources and cloud metadata | postiz | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34966 | Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass | Gitea | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-41271 | Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains | flowise | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-52769 | YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub Signature.keyId | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390719 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-54549 | Meta Ads MCP: Server-Side Request Forgery (SSRF) in upload_ad_image via Unrestricted image_url Fetch | meta-ads-mcp | Protected by Atomicorp rules | 334168 , 390719 |
| CVE-2026-59095 | LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl | lobehub | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-63313 | 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch | 9router | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-65056 | mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering | mcp-webresearch | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-76225 | ArcadeDB before 26.8.1 Server-Side Request Forgery via LOAD CSV | arcadedb | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 390109 , 398021 , 398022 |
| CVE-2026-79659 | Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo | Ech0 | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-82243 | Budibase Server before 3.41.3 SSRF with Credential Leakage | server | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-84196 | Kyverno before 1.18.0 Server-Side Request Forgery via apiCall | kyverno | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-86771 | Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num | snipe-it | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-90769 | Open Notebook before 1.11.0 Server-Side Request Forgery via link-source | open-notebook | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-91943 | Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy | crawl4ai | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2020-13379 | Grafana 3.0.1-7.0.1 - Server-Side Request Forgery | grafana | Protected by Atomicorp rules | 340165 |
| CVE-2024-21893 | Ivanti Connect Secure Unauthenticated Remote Code Execution | connect secure | Protected by Atomicorp rules | 337109 , 337110 , 392301 , 398021 , 398022 |
| CVE-2026-116192 | rclone from 1.37 before 1.74.2 SSRF via –rc-serve scheme-relative remote roots | rclone | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-116826 | YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-116827 | YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-16268 | Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler | Newsletters | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-43910 | Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor | java-client | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54691 | datamodel-code-generator vulnerable to SSRF via –url: no host/IP validation, follows redirects | datamodel-code-generator | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-61638 | Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port | Wallos | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-77348 | Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.ph | Wallos | Protected by Atomicorp rules | 337109 , 337110 , 340790 , 340791 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82262 | Logto Server-Side Request Forgery via webhook test endpoint | logto | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2025-61784 | LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities | llama-factory | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-69222 | LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions | librechat | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-34365 | InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34366 | InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-49213 | TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution | typebot.io | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-50143 | Actor MCP path authority injection leaks Apify token | apify-mcp-server | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-51773 | SSRF | - | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-77294 | TREK: Server-Side Request Forgery via User-Configurable LLM Base URL | TREK | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-79425 | CRMEB v6.0.0 Server-Side Request Forgery Vulnerability | CRMEB v6.0.0 | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-68696 | httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage | httparty | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-40280 | Gotenberg <= 8.30.1 - Server Side Request Forgery | gotenberg | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 344362 , 398021 , 398022 |
| CVE-2026-55864 | GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool | core-geonetwork | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104977 | Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebindi | plane | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-33655 | New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs | new api | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34163 | Server-Side Request Forgery via MCP Tools Endpoint in FastGPT | fastgpt | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-34936 | PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback | praisonai | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-39361 | OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url | openobserve | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-39843 | Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching | plane | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-39965 | TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks | typebot.io | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-40348 | Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing | movary | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-42345 | FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, a | FastGPT | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-43884 | WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() | AVideo | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44285 | FastGPT: SSRF Protection Bypass via externalFile in Dataset Preview API | FastGPT | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-45806 | Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url | penpot | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-46717 | Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification | nezha | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-47170 | Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint | garlic-hub | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-47684 | Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP | server | Protected by Atomicorp rules | 390719 |
| CVE-2026-53549 | Termix: Server-Side Request Forgery via Proxy Connectivity Test | Termix | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54339 | Glean: Server-Side Request Forgery (SSRF) with Full Response Disclosure via Malicious RSS Feed in /api/feeds/discover | glean | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-54607 | FastGPT: SSRF in HTTP-tool OpenAPI schema importer via SwaggerParser $ref (bypasses the isInternalAddress guard) | FastGPT | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-56285 | Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint | nitter | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-58314 | Two SSRF findings in Gitea 1.26.2 | Gitea Open Source Git Server | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-61835 | Directus: SSRF Protection Bypass via 0.0.0.0 in File Import | directus | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-62242 | Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration | spring-boot-admin | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-63088 | stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass | stoatchat | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63464 | Nebula-mesh allows non-admin operators to disable webhook SSRF protection via allow_private | nebula-mesh | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-63764 | LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass | lmdeploy | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-67346 | Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass | swarms | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-69192 | ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trus | ip-address | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-71303 | Lemur: Incomplete fix for CVE-2026-55166 – ACME authority update endpoint allows non-admin to replace acme_url with i | lemur | Protected by Atomicorp rules | 337109 , 337110 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-71365 | Awx: webhook status callback ssrf leaks the git pat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-75888 | Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch | Red Hat OpenShift Container Platform 4.14 | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-76820 | OpenCTI: Synchronizer SSRF: stream fetch has no URL validation | opencti | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-76898 | draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js | drawio | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-77775 | Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation | Headroom | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390719 , 390722 , 398021 , 398022 |
| CVE-2026-79764 | Termix: Authenticated SSRF via /homepage/proxy — No Destination Allowlist | Termix | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-100858 | heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes | heym | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-104973 | Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery | plane | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-105628 | Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint | plane | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-45082 | Karakeep has a SSRF Protection Bypass via Redirect Handling | karakeep | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-55160 | Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer | stringer | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 350147 , 398021 , 398022 |
| CVE-2026-55177 | CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guar | CloudTAK | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-55232 | Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy | Vvveb | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-79749 | MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation | mcphub | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2019-9621 | Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF | zimbra collaboration suite | Protected by Atomicorp rules | 344360 , 344370 , 344372 , 350147 |
| CVE-2021-21975 | VMware vRealize Operations (vROps) Manager SSRF RCE | cloud foundation | Protected by Atomicorp rules | 334168 |
| CVE-2021-40822 | GeoServer Unauthenticated Server-Side Request Forgery (CVE-2021-40822) | geoserver | Protected by Atomicorp rules | 340007 |
| CVE-2021-46107 | Ligeo Archives Ligeo Basics - Server Side Request Forgery | ligeo basics | Protected by Atomicorp rules | 340162 , 340165 , 344360 , 347009 |
| CVE-2023-36661 | Ivanti Connect Secure Unauthenticated Remote Code Execution | xmltooling | Protected by Atomicorp rules | 337109 , 337110 , 398021 , 398022 |
| CVE-2024-6587 | LiteLLM - Server-Side Request Forgery | litellm | Protected by Atomicorp rules | 340162 , 340163 |
| CVE-2025-27817 | Apache Kafka Client - Arbitrary File Read | kafka | Protected by Atomicorp rules | 344360 |
| CVE-2025-59527 | FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability | flowise | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-61884 | Oracle E-Business Suite - Server-Side Request Forgery | configurator | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 341256 , 342259 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-0560 | LolLMS < 2.2.0 - Server-Side Request Forgery | lollms | Protected by Atomicorp rules | 360151 |
| CVE-2026-113728 | Bulwark Webmail: DNS-rebinding SSRF in public iCalendar fetch endpoint | webmail | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-24138 | FOG vulnerable to unauthenticated SSRF via /fog/service/getversion.php | fogproject | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-35036 | Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature | ech0 | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-50151 | oras-go: credential forwarding via unvalidated Location header in blob upload | oras | Protected by Atomicorp rules | 390719 |
| CVE-2026-53754 | Crawl4AI: SSRF filter bypass in Docker server via IPv6 transition forms (NAT64 / 6to4 / unspecified / v4-mapped) | crawl4ai | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-59765 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | Gitea Open Source Git Server | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-81265 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | langflow | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-95265 | Feehi CMS 2.1.1 Server-Side Request Forgery Vulnerability | Feehi CMS 2.1.1 | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2017-9355 | Subsonic 6.1.1 - XML External Entity Injection | subsonic | Protected by Atomicorp rules | 390726 , 392301 , 392647 , 392648 |
| CVE-2026-45310 | CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Tool | CodeWhale | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-49857 | auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback | auth-fetch-mcp | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398004 , 398021 , 398022 |
| CVE-2026-56676 | 9router: Image prefetch DNS rebinding allows SSRF to internal services | 9router | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-70666 | Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs | lemur | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-45869 | LogicalDOC Enterprise Version up to and before v9.1.1 Server-Side Request Forgery Vulnerability | - | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-35587 | Glances IP Plugin has SSRF via public_api that leads to credential leakage | glances | Protected by Atomicorp rules | 390719 |
| CVE-2026-114730 | Webmail Server-Side Request Forgery Vulnerability | Webmail | Protected by Atomicorp rules | 330708 , 390712 , 390722 |
| CVE-2026-33715 | Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action | chamilo lms | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-45019 | Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network access | chainlit | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-54544 | Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints | fireshare | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-57114 | PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding | PraisonAI | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-6229 | Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter | Royal Addons for Elementor – Addons and Templates Kit for Elementor | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-65958 | Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/we | open webui | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-100849 | AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs | AzuraCast | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-100859 | Heym before 0.0.106 Credential Exfiltration via URL Override | heym | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-107362 | Server-Side Request Forgery in Malcolm | Malcolm | Protected by Atomicorp rules | 337109 , 337110 , 340813 , 340814 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-111313 | JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch | JobOps | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-22664 | prompts.chat SSRF via Fal.ai Media Status Polling | prompts.chat | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-39370 | WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltr | avideo | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-40160 | PraisonAIAgents has SSRF via unvalidated URL in web_crawl httpx fallback | praisonaiagents | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-41272 | Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) | flowise | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-42339 | New API: SSRF Filter Bypass via 0.0.0.0 | new api | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-47735 | Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks | arc | Protected by Atomicorp rules | 340007 , 344360 , 390709 , 390719 |
| CVE-2026-54077 | ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users | arcadedb | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54166 | Shelf Vulnerable to Server-Side Request Forgery (SSRF) via Asset CSV Import imageUrl Validation Bypass | shelf.nu | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-55096 | SSRF via DNS-resolution gap in _validate_url_security (file download by URL) | fast-mcp-telegram | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-55537 | PraisonAI: Webhook SSRF via DNS fail-open in JobSubmitRequest.validate_webhook_url() — bypass of CVE-2026-40114 | PraisonAI | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-55787 | Flyto2 Core: SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf | flyto-core | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-57303 | assembla Server-Side Request Forgery Vulnerability | assembla | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-58485 | mcp-searxng: DNS-resolved Private Hostname SSRF in web_url_read | mcp-searxng | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-74247 | Quay: ssrf via build archive_url in quay build api | openshift update service | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-75844 | ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass | arcadedb | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-79747 | MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy | mcphub | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-79788 | Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address | dradis-ce | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-80350 | OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL | OneUptime | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-82241 | Budibase backend-core SSRF via incomplete default blacklist | server | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82246 | Budibase Server before 3.41.3 SSRF via Query Import | server | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-85163 | AVideo Server-Side Request Forgery via epg_link parameter | AVideo | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85164 | WWBN AVideo Server-Side Request Forgery via set_api_userImages | AVideo | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-87821 | Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch | laradashboard | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-87999 | Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch | open webui | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-91750 | WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects | WeKnora | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92775 | Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch | Wiki.js | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92804 | Nango through 0.70.4 Server-Side Request Forgery via Configuration | Nango | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2019-6793 | GitLab Enterprise Edition - Server-Side Request Forgery | gitlab | Detected by Atomicorp rules | 390616 |
| CVE-2026-10107 | MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint | MoviePilot | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-101898 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls | axios | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-116066 | Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service | Firecrawl | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-10695 | OpenSupports 4.11.0 — SSRF via test imap and smtp endpoints | opensupports | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-11864 | NucleoidAI Nucleoid Outbound Request cluster.ts extension.apply server-side request forgery | Nucleoid | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-34282 | ThingsBoard < v4.2.1 SVG Image SSRF | thingsboard | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-100601 | ClawHub SSRF via Unchecked DNS Resolution in Profile Image | clawhub | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-100696 | Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver | adminer | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-103530 | decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery | 9Router | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-104440 | YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104441 | YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104442 | YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-104459 | YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-108554 | PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input | PDFMathTranslate | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-108850 | Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup | company-research-agent | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-109239 | Crawl4AI before 0.9.4 Blind SSRF via RobotsParser.can_fetch robots.txt Fetch | crawl4ai | Protected by Atomicorp rules | 337109 , 337110 , 340163 , 398021 , 398022 |
| CVE-2026-110222 | Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup | IFSC | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-110719 | Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header | gateway | Protected by Atomicorp rules | 390719 |
| CVE-2026-111320 | ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check | ValueCell | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-111662 | Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint | chaskiq | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-111720 | fish-island-backend through commit 7c61b78 SSRF via /api/web/parse | fish-island-backend | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-112267 | SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker | sglang | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-116069 | NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field | niubigeo | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-116205 | YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax | yeswiki | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34964 | Adminer before 5.5.0 SSRF via PDO DSN Injection | adminer | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-39383 | Gotenberg unauthenticated blind SSRF via unfiltered webhook URL | gotenberg | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-44652 | SillyTavern: SSRF vulnerability in the CORS proxy middleware | SillyTavern | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54885 | Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching | boruta | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-59101 | AutoBangumi < 3.2.8 - SSRF via /api/v1/setup/test-downloader | Auto Bangumi | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-60091 | PraisonAI before 4.6.78 Unauthenticated SSRF via webhook_url | PraisonAI | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-61793 | Nuxt OG Image has unauthenticated SSRF via fonts[].path URL parameter | og-image | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63086 | text-generation-inference 3.3.7 SSRF via fetch_image in multimodal chat completions | text-generation-inference | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-63096 | Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint | dendrite | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-73058 | stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass | stoatchat | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-81678 | AVideo SSRF Guard Bypass via IPv6 Transition Addresses | AVideo | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-84199 | Kyverno before 1.16.2 SSRF via APICall Feature | kyverno | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-85609 | Openpanel before 2.3.0 SSRF via Site Checker Endpoint | openpanel | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-85662 | Marqo 2.26.0 Server-Side Request Forgery via Media URLs | marqo | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-86539 | knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint | knowns | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-86806 | opengeos GeoLibre _is_within_roots server-side request forgery | GeoLibre | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 350591 , 390722 , 398021 , 398022 |
| CVE-2026-8712 | Wyoming < 1.10.2 SSRF via uri Query Parameter | wyoming | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-89242 | WWBN AVideo Unauthenticated SSRF via login.json.php | AVideo | Protected by Atomicorp rules | 337109 , 337110 , 398022 |
| CVE-2026-91081 | Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint | docs | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-91966 | AVideo through 29.0 Unauthenticated SSRF via Host Header | AVideo | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-92813 | Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass | Metabase | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-12136 | Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via sca | Real Cookie Banner: GDPR & ePrivacy Cookie Consent | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-102354 | BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker | bentopdf | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-55421 | Open edX Platform: SSRF in Studio Video Download Endpoint | openedx-platform | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-63334 | draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist | drawio | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-76900 | CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime | CordysCRM | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-53708 | ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (/admin/gateways/test) | mcp-context-forge | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2017-3546 | Oracle PeopleSoft - Server-Side Request Forgery | peoplesoft enterprise peopletools | Protected by Atomicorp rules | 390727 , 392301 , 392648 |
| CVE-2022-1398 | External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery | external media without import | Detected by Atomicorp rules | 377360 |
| CVE-2023-3188 | Owncast - Server Side Request Forgery | owncast | Protected by Atomicorp rules | 392301 |
| CVE-2024-27564 | ChatGPT个人专用版 - Server Side Request Forgery | chatgpt web | Protected by Atomicorp rules | 340165 , 344360 , 347009 |
| CVE-2024-34319 | Server-Side Request Forgery | - | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-50234 | mccms Arbitrary Code Execution Vulnerability | mccms | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-54249 | Adobe Experience Manager ≤ 6.5.23.0 – SSRF | experience manager | Protected by Atomicorp rules | 390726 , 392647 |
| CVE-2025-67743 | Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service | local deep research | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-68477 | Langflow vulnerable to Server-Side Request Forgery | langflow | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-115886 | MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI e | mlflow | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-12767 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | Langflow OSS | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-15974 | sglang Server-Side Request Forgery Vulnerability | sglang | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-17557 | Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding | Red Hat OpenShift AI (RHOAI) | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-26379 | koha Server-Side Request Forgery Vulnerability | koha | Protected by Atomicorp rules | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-31941 | Server-Side Request Forgery (SSRF) in Chamilo LMS | chamilo lms | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34740 | AVideo: Stored SSRF via Video EPG Link Missing isSSRFSafeURL() Validation | avideo | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-39368 | WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services | avideo | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-41060 | AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL | avideo | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-42181 | Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image | lemmy | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-46556 | FlaskBB: SSRF in get_image_info() via unrestricted avatar URL | flaskbb | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-51772 | Server-Side Request Forgery | - | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-52371 | xxl-job v3.4.0 Server-Side Request Forgery Vulnerability | xxl-job v3.4.0 | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-54054 | Transmute has full-read SSRF in URL file import (POST /api/files/url) — no host/IP validation, follows redirects | transmute | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-54688 | mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off) | mcp-searxng | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-58418 | SSRF via HTTP Redirect in Repository Migration | Gitea Open Source Git Server | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-58442 | Repository migration SSRF via multi-answer DNS allow-list bypass | Gitea Open Source Git Server | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-62282 | OpenCVE: Server-Side Request Forgery (SSRF) in notifications | opencve | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-88403 | nocobase v2.1.21 Server-Side Request Forgery Vulnerability | nocobase v2.1.21 | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-11361 | Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery | Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-45573 | Decidim: Push subscriptions can be abused for server-side requests | decidim | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-47268 | Nezha Monitoring: Authenticated DDNS webhook configuration allows blind SSRF from the dashboard host | nezha | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-56678 | 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding | 9router | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-79717 | Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction | Red Hat Ansible Automation Platform 2 | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-79760 | Termix: Authenticated blind SSRF through notification channel test endpoints | Termix | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-82081 | wallabag Server-Side Request Forgery Vulnerability | wallabag | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-100681 | Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook | server | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-102983 | Astro: Netlify Image CDN allowlist bypass enables SSRF | astro | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-110652 | ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass | DocumentServer | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-111171 | Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass | web3.py | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-115717 | Frappe Builder before 1.36.1 SSRF via convert_to_webp | builder | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-115810 | Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL | recipes | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-42180 | Lemmy: SSRF in /api/v3/post via Webmention dispatch | lemmy | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-42335 | MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy | MaxKB | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44284 | FastGPT: Stored MCP tool URL SSRF in FastGPT workflow execution | FastGPT | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-49120 | Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint | medplum | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-54020 | Open WebUI: DNS Rebinding SSRF Bypass | open webui | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56769 | Huly Platform - Server-Side Request Forgery via /import Endpoint | platform | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-56771 | NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint | NewsBlur | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-57947 | Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration | pinpoint | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-63107 | LimeSurvey SSRF via REST API Survey Template Host Header | LimeSurvey | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63643 | MagicMirror: ssrf calendar .js | MagicMirror | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-63731 | HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint | hyperdx | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-63769 | Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method | huginn | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-65593 | n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters | n8n | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-67620 | Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List | flowise | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-70667 | Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fi | lemur | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-72860 | 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unre | 9router | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-73530 | Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip() | flyto-core | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-82044 | UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf | UTMStack | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-85738 | TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4) | TREK | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-86590 | Eclipse Che Server-Side Request Forgery Vulnerability | Eclipse Che | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-91079 | Huly Platform through 0.7.426 SSRF via Print Service | platform | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2017-9506 | Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery | oauth | Protected by Atomicorp rules | 382291 |
| CVE-2026-70620 | Odysseus SSRF via Embedding Endpoint Configuration | odysseus | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-105689 | Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download | penpot | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-41689 | Wallos: Shared local webhook allowlist lets low-privilege users send arbitrary requests to allowlisted internal services | Wallos | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-55473 | HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadat | homebox | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-56275 | Flowise - Server-Side Request Forgery via Execute Flow Base URL | flowise | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-86735 | snipe-it before 8.7.0 SSRF via IPv6 transition address bypass | snipe-it | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2020-5775 | Canvas LMS v2020-07-29 - Blind Server-Side Request Forgery | canvas learning management service | Protected by Atomicorp rules | 340162 , 340163 |
| CVE-2024-6095 | LocalAI - Partial Local File Read | localai | Protected by Atomicorp rules | 344360 |
| CVE-2025-11427 | WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery | WP Migrate Lite – Migration Made Easy | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-10526 | EmbedPress < 4.6.1 - Unauthenticated Blind SSRF | EmbedPress | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-105743 | Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTM | docling | Protected by Atomicorp rules | 390719 |
| CVE-2026-111761 | A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery | a2a-java | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-34360 | HAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing | hl7 fhir core | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-34981 | whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3 | whisperx rest api | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-45709 | Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filte | mailpit | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-47160 | Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass | vaultwarden | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48053 | Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset | kolibri | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-55187 | Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) | mailpit | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-55591 | Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints | signalk-server | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-73243 | kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass | kkFileView | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44520 | Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler | docling-graph | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-10874 | Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-11046 | Tencent WeKnora test testEmbeddingModel server-side request forgery | weknora | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-13814 | moxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl.uploadPictureByUrl server-side request forgery | mogublog | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-100893 | Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery | VoceChat Server | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-100901 | athlon1600 youtube-downloader stream.php stream server-side request forgery | youtube-downloader | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-100909 | OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery | the file modules/system/classes/ResizeImages.php | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-101005 | October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery | October CMS | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-10280 | horizon921 mcpilot MCP API Call Endpoint route.ts server-side request forgery | mcpilot | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10287 | SourceCodester SEO Meta Tag Extractor index.php get_headers server-side request forgery | SEO Meta Tag Extractor | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-105148 | SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery | R2R | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-105290 | feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery | feelcrm-os | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-116000 | Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery | PrivateGPT | Protected by Atomicorp rules | 340007 , 344360 , 390709 |
| CVE-2026-116256 | geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery | RhaPHP | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-16016 | poco-ai poco-claw task.py run_task server-side request forgery | poco-claw | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16125 | zevorn rt-claw http_request net.c claw_net_post server-side request forgery | rt-claw | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16127 | zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery | rt-claw | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16128 | zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery | rt-claw | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-16910 | Quay: ssrf in red hat quay notification webhooks (slack/generic) | Red Hat OpenShift Update Service | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-18973 | heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery | super-agent-party | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19000 | JeecgBoot Anonymous Chat Attachment send server-side request forgery | JeecgBoot | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19374 | adafap api-mcp Proxy API Endpoint route.ts customAxios server-side request forgery | api-mcp | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19753 | Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery | mcp-rdf-explorer | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-41130 | Craft CMS has a host header injection leading to SSRF via resource-js endpoint | cms | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-5346 | huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery | hm editor | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5832 | atototo api-lab-mcp HTTP http-server.ts test_http_endpoint server-side request forgery | api-lab-mcp | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-6604 | modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery | agentscope | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-6606 | modelscope agentscope _agent_base.py _process_audio_block server-side request forgery | agentscope | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-6625 | moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-si | Mogu Blog v2 | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-7065 | BidingCC BuildingAI Remote Upload API file-storage.service.ts uploadRemoteFile server-side request forgery | BuildingAI | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-7094 | ShadowCloneLabs GlutamateMCPServers puppeteer_navigate index.ts server-side request forgery | glutamate mcp servers | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-7146 | AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery | mcp-data-vis | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-7147 | JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery | mcp-chat-studio | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-7158 | dmitryglhf mcp-url-downloader server.py _validate_url_safe server-side request forgery | mcp-url-downloader | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-7177 | ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery | nextchat | Protected by Atomicorp rules | 390719 |
| CVE-2026-7178 | ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery | nextchat | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-7221 | TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery | CloudBase-MCP | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-7223 | BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery | HyperChat | Protected by Atomicorp rules | 334168 , 390719 |
| CVE-2026-76795 | AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery | PullMD | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-81421 | ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery | sentry-selfhosted-mcp | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-82630 | PowerJob Transport Endpoint TestController.java MuConnectionManager.getOrCreateConnection server-side request forgery | PowerJob | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-82801 | NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery | earthdata-search | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-82802 | NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery | earthdata-search | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85380 | light0011 cms UEditor controller.php catchimage server-side request forgery | cms | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-86237 | openagents-org openagents http.py test_default_model server-side request forgery | openagents | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-86273 | projeto-siga HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl server-side request forgery | siga | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-8725 | CoreWorxLab CAAL test-hass Endpoint webhooks.py server-side request forgery | CAAL | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92380 | WuzhiCMS Remote Image Fetch index.php saveRemote server-side request forgery | WuzhiCMS | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-9372 | ItzCrazyKns Vane Model Provider API route.ts server-side request forgery | Vane | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-94038 | NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery | dim-sum-app | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-94039 | vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery | TaxHacker | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-94040 | vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery | TaxHacker | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-102923 | SparkyFitness: SSRF via unvalidated custom_url in AI service settings | SparkyFitness | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-114620 | Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF | authlib | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-34590 | Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation | postiz | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-48483 | TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server | typebot.io | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-48762 | TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler | typebot.io | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-6394 | Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter | Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-7798 | FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter | FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 340464 , 340465 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2024-20404 | Cisco Finesse - Server-Side Request Forgery (SSRF) | finesse | Protected by Atomicorp rules | 392301 |
| CVE-2026-100697 | Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver | adminer | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-100861 | heym before 0.0.105 SSRF via credential-controlled base URLs | heym | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-105122 | OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri | OpenAM | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-107273 | Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site | gophish | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-108719 | LLMGateway through 1.20.0 Blind SSRF via Video-Generation callback_url | LLMGateway | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-110254 | Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory | dockhand | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-111321 | TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions | TaskingAI | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114076 | Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL | trigger.dev | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114080 | Trigger.dev before 4.5.2 Blind SSRF via Alert-Channel Webhook URL | trigger.dev | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114362 | HarnessRouter Targets Test Endpoint app.py server-side request forgery | HarnessRouter | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-114634 | WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect | AVideo | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-115411 | crawlseo before 0.2.4 Server-Side Request Forgery via Crawler | crawlseo | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-115720 | Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect | builder | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-14860 | Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery | Podcast Player | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16536 | Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id | Simple Google Calendar Outlook Events Widget | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19956 | gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery | facebook-ads-mcp-server | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-22662 | prompts.chat Blind SSRF via media-generate | prompts.chat | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-25946 | Gitea OpenID discovery server-side request forgery | Gitea | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-33766 | AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints | avideo | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-40100 | FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default | fastgpt | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-44202 | OpenAM Authenticated Server-Side Request Forgery (SSRF) via /sessionservice | OpenAM | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44583 | Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module | Paymenter | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390719 , 390722 , 398021 , 398022 |
| CVE-2026-49138 | Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following | nanobot | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-49345 | Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF) | mercator | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54300 | @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config | astro | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54508 | TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution | TREK | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-5538 | QingdaoU OnlineJudge judge_server_heartbeat Endpoint JudgeServer.service_url server-side request forgery | OnlineJudge | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-55414 | NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-suppli | nl-portal-backend-libraries | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-56779 | MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters | MaxKB | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-59231 | Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs | Pentestify | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-63730 | HyperDX < 2.31.0 SSRF via Webhook Test Endpoint | hyperdx | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-64626 | AVideo Encoder downloadURL SSRF via unpinned retry fallback | AVideo | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-64870 | MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation | MaxKB | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-72846 | Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery | lightdash | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-73082 | Activepieces: Server-side request forgery in MCP tool validation endpoint | activepieces | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-73845 | CKAN MCP Server: MQA server allowlist bypass via unanchored regex (isValidMqaServer) | ckan-mcp-server | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-74858 | jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery | fetcher-mcp | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-76239 | Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address | stigmem-node | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-77067 | Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation | omnivore | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-78231 | Gitea blind SSRF through OpenID assertion verification | Gitea | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-82040 | UTMStack < 11.2.16 SSRF via IdentityProviderService | UTMStack | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-84175 | Eclipse Ditto Uncontrolled Recursion Vulnerability | Eclipse Ditto | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-84207 | Heym before 0.0.98 SSRF via WebSocket endpoints | heym | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-85650 | Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel | trigger.dev | Protected by Atomicorp rules | 334168 , 337109 , 337110 , 344360 , 390719 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-88892 | OpenPanel SSRF via Unguarded Importer File URL Fetch | openpanel | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-91199 | Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint | refly | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-91967 | AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL | AVideo | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92184 | ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery | ag-ui | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-92569 | Hippo4j through 1.5.0 SSRF via clientAddress Parameter | hippo4j | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-93597 | ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses | arcadedb | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-96652 | Plex Media Server SSRF | media server | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 , 398123 |
| CVE-2026-96655 | Plex Media Server arbitrary-host SSRF | media server | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 , 398126 |
| CVE-2023-53899 | PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection | podcast generator | Protected by Atomicorp rules | 337109 , 337110 , 398021 , 398022 |
| CVE-2026-100373 | OpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass | OpenMetadata | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-105263 | Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery | Shaarli | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-110225 | Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route | Shaarli | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-17597 | Nexus Repository 3 - Server-Side Request Forgery via Email Configuration Verification | nexus repository manager | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-42213 | SolidCAM-GPPL-IDE: Path traversal in inc directive enables file probing and NTLM-hash leak | SolidCAM-GPPL-IDE | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2026-42336 | MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch | MaxKB | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-54430 | Server-Site Request Forgery in liboauth2 | liboauth2 | Protected by Atomicorp rules | 390719 |
| CVE-2026-79671 | Ech0 before 4.4.3 SSRF via DNS Resolution Bypass | Ech0 | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-11536 | Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery | Element Pack – Widgets, Templates & Addons for Elementor | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-28385 | SSRF via image import from URL allows internal network probing by authenticated users | lxd | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-35516 | LinkAce has SSRF via CheckLinksCommand - Link URL Update Bypasses laravel-html-meta Protection | linkace | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-43979 | Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (pdf_service.py:_markdown_to_html) | local-deep-research | Protected by Atomicorp rules | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-54546 | CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard | CloudTAK | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-78850 | Matomo v.5.11.2 Information Disclosure Vulnerability | - | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-79723 | Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches | langflow | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-76083 | Redash: JSON data source query URL can bypass base URL restriction | redash | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-100850 | AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist | AzuraCast | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-55374 | canto-saas-api: Authenticated API requests can be redirected via unencoded path variables | canto-saas-api | Protected by Atomicorp rules | 340162 , 340163 , 340165 , 344365 |
| CVE-2025-69206 | Hemmelig has SSRF Filter bypass in Secret Request functionality | hemmelig | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-101029 | Gitea migration and pull mirror SSRF through multi-answer DNS | gitea | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-113671 | ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated S | apostrophe | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-33534 | EspoCRM <= 9.3.3 - Server-Side Request Forgery | espocrm | Protected by Atomicorp rules | 398003 |
| CVE-2026-34170 | Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL | coolify | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-42188 | Geyser: Server-Side Request Forgery (SSRF) via Player Head Texture URL | geyser | Protected by Atomicorp rules | 337109 , 337110 , 398021 , 398022 |
| CVE-2026-43936 | e107: Server-Side Request Forgery (SSRF) in the remote file fetcher | e107 | Protected by Atomicorp rules | 337109 , 337110 , 341737 , 341738 , 344360 , 398021 , 398022 |
| CVE-2026-49856 | @jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization | jshookmcp | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-55875 | Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network | platform | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-77352 | Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user) | Wallos | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398021 , 398022 |
| CVE-2026-77522 | MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no inter | MaxKB | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-10052 | Quay/config-tool: quay/config-tool: ssrf via unfiltered ldap and smtp config validation endpoints | Red Hat Quay 3 | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-48013 | Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation | shopware | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-61681 | Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler | hatchet | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-48051 | Papra: SSRF via HTTP redirect bypass in webhook delivery | papra | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-77351 | Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings | Wallos | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-107449 | Heimdall Server-Side Request Forgery Vulnerability | Heimdall | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-23603 | Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim | Gitea Open Source Git Server | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-48707 | InstantCMS vulnerable to SSRF via upload redirect bypass allows internal network service scanning | icms2 | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-62505 | SSRF in lobehub/lobe-chat with native web fetch module | lobe-chat | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-49262 | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy | pagible | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-68927 | MobSF: SSRF port restriction bypass in assetlinks_check | Mobile-Security-Framework-MobSF | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-112076 | alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forge | MeTube | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 390719 , 398021 , 398022 |
| CVE-2026-52840 | Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal netwo | easyappointments | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-62719 | LinkAce: Limited Server-Side Request Forgery (SSRF) in Keyword Fetching Functionality | linkace | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-101061 | utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass | python-utcp | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-110223 | Kavita 0.9.0 through 0.9.1.4 SSRF Blocklist Bypass via upload-cbl-file Endpoint | Kavita | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-115752 | Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon | signalk-server | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-44286 | FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation | FastGPT | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-73087 | Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher | dozzle | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-41321 | @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint | @astrojs/cloudflare | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-77648 | Glance Server-Side Request Forgery Vulnerability | Glance | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-10787 | MuYuCMS Add Fiend Link index.html server-side request forgery | MuYuCMS | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-13174 | rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery | WeRSS we-mp-rss | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-13789 | ZenTao model.php makeRequest server-side request forgery | zentao | Protected by Atomicorp rules | 337109 , 337110 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2025-13809 | orionsec orion-ops SSH Connection MachineInfoController.java server-side request forgery | orion ops | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2025-14518 | PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgery | powerjob | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-15098 | YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery | yudao-cloud | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-102244 | MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery | SurfSense | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-10239 | JeecgBoot edit WordUtil.addImage server-side request forgery | JeecgBoot | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-10240 | JeecgBoot test server-side request forgery | the file /airag/airagModel/test | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-10241 | jeecgboot The server processes these URLs Cloud Instance Metadata Endpoint debug FileDownloadUtils.download2DiskFromNet | The server processes these URLs | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10274 | indrasishbanerjee aem-mcp-server Axios Request Flow mcp-server.ts getAssetMetadata server-side request forgery | aem-mcp-server | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10276 | hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery | Jenkins-server-mcp | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-105438 | O2OA General url ActionUploadExcelWithUrl server-side request forgery | O2OA | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10662 | ahujasid blender-mcp ZIP File server.py requests.get server-side request forgery | blender-mcp | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-10690 | wonderwhy-er DesktopCommanderMCP read_file filesystem.ts readFileFromUrl server-side request forgery | DesktopCommanderMCP | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-108523 | Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery | Sencho | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-108542 | 021is elvix-sdk MCP Request index.ts server-side request forgery | elvix-sdk | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-108787 | houtini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery | voice-analyser-mcp | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-109402 | conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery | conductor | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-112254 | agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery | clientst0r | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-114374 | leomoon-studios wiki-go fetch-metadata Endpoint metadata_api.go server-side request forgery | wiki-go | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-116224 | fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery | benotes | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-12210 | universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery | python-utcp | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-12774 | BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery | litellm | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-12798 | BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery | litellm | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-14748 | AIAnytime Awesome-MCP-Server mcp-wiki/wiki-summary server.py server-side request forgery | Awesome-MCP-Server | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-15500 | AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery | AstrBot | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15501 | AstrBotDevs AstrBot MCP Test Endpoint tools.py ToolsRoute.test_mcp_connection server-side request forgery | AstrBot | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-15619 | mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery | clawlet | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15620 | mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery | clawlet | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15624 | nextlevelbuilder GoClaw invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo server-side request forgery | GoClaw | Protected by Atomicorp rules | 334168 , 390719 |
| CVE-2026-15628 | zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery | chatgpt-on-wechat CowAgent | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-15750 | mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery | mastergo-magic-mcp | Protected by Atomicorp rules | 390719 |
| CVE-2026-16074 | AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery | AstrBot | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16124 | nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery | GoClaw | Protected by Atomicorp rules | 334168 , 390719 |
| CVE-2026-16194 | zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery | CowAgent | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-16222 | 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery | CordysCRM | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-16223 | 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery | CordysCRM | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-17458 | mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery | openclaw-cn | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-18774 | NousResearch hermes-agent xAI Image Generation Provider image_gen_provider.py save_url_image server-side request forgery | hermes-agent | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19040 | MissionSquad mcp-api dcrClients.ts server-side request forgery | mcp-api | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19246 | HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery | nanobot | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19340 | anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery | ProjectHub-Mcp | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19375 | dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery | article-scraper-mcp | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19752 | EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery | mcp-dominican-layer | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19927 | OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery | OpenBoxes | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-19984 | jkawamoto mcp-florence2 init.py get_images server-side request forgery | mcp-florence2 | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-5470 | mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request for | Google-Research-MCP | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5607 | imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery | mcp-browser-agent | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5803 | bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgery | openai-realtime-ui | Detected by Atomicorp rules | 337109 , 340162 , 347009 , 390722 |
| CVE-2026-6111 | FoundationAgents MetaGPT common.py decode_image server-side request forgery | metagpt | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-6119 | AstrBotDevs AstrBot API Endpoint post_data.get server-side request forgery | AstrBot | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-6616 | TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery | SuperAGI | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-6649 | Qibo CMS headers server-side request forgery | CMS | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-6979 | devlikeapro WAHA API Request media.controller.ts server-side request forgery | WAHA | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-7150 | dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgery | auto-favicon | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-74842 | Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery | PromptShopMCP | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-7729 | pixelsock directus-mcp MCP index.ts validateUrl server-side request forgery | directus-mcp | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-7890 | Concrete CMS 9.5.0 is vulnerable to SSRF via RSS Displayer Block | concrete cms | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-8081 | router-for-me CLIProxyAPI api_tools.go server-side request forgery | cliproxyapi | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-82905 | sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery | chats | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398001 , 398008 , 398021 , 398022 |
| CVE-2026-83744 | invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery | Invoice Ninja | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398001 , 398021 , 398022 |
| CVE-2026-90580 | FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery | flowise | Protected by Atomicorp rules | 390719 |
| CVE-2026-90814 | cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery | mercury-agent | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-92527 | chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery | chatwoot | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-94028 | mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request fo | Mealie | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-14116 | xerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery | Yuxi-Know | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-15414 | go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery | sonic | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-100900 | DevaslanPHP project-management Jira Import jira-import updateJiraProjects server-side request forgery | project-management | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-10583 | nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery | GoClaw | Protected by Atomicorp rules | 334168 , 390719 |
| CVE-2026-108521 | Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery | Sencho | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-18856 | Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery | Rhymix CMS | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-82667 | yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger | GEOFlow | Protected by Atomicorp rules | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-86240 | liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery | FeehiCMS | Protected by Atomicorp rules | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-9464 | YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery | yudao-cloud | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-19369 | KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get server-side request forgery | jira-mcp-server | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2026-19373 | PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery | KoboldCPP-MCP-Server | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-5323 | priyankark a11y-mcp index.js A11yServer server-side request forgery | a11y-mcp | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-40072 | web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling | web3.py | Protected by Atomicorp rules | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 310047 | Active | disruptive (deny) |
| 330708 | Active | disruptive (deny) |
| 330791 | Active | disruptive (deny) |
| 330925 | Active | disruptive (deny) |
| 333140 | Active | disruptive (deny) |
| 333141 | Active | disruptive (deny) |
| 334168 | Active | disruptive (deny) |
| 337109 | Active | disruptive (deny) |
| 337110 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340014 | Active | disruptive (deny) |
| 340016 | Active | disruptive (deny) |
| 340017 | Active | disruptive (deny) |
| 340023 | Active | disruptive (deny) |
| 340029 | Active | disruptive (deny) |
| 340087 | Active | disruptive (deny) |
| 340095 | Active | disruptive (deny) |
| 340099 | Active | disruptive (deny) |
| 340121 | Active | disruptive (deny) |
| 340144 | Active | disruptive (deny) |
| 340145 | Active | disruptive (deny) |
| 340147 | Active | disruptive (deny) |
| 340148 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 340156 | Active | disruptive (deny) |
| 340157 | Active | disruptive (deny) |
| 340162 | Active | disruptive (deny) |
| 340163 | Active | disruptive (deny) |
| 340165 | Active | disruptive (deny) |
| 340193 | Active | disruptive (deny) |
| 340464 | Active | disruptive (deny) |
| 340465 | Active | disruptive (deny) |
| 340790 | Active | disruptive (deny) |
| 340791 | Active | disruptive (deny) |
| 340813 | Active | disruptive (deny) |
| 340814 | Active | disruptive (deny) |
| 341099 | Active | disruptive (deny) |
| 341245 | Active | disruptive (deny) |
| 341256 | Active | disruptive (deny) |
| 341266 | Active | disruptive (deny) |
| 341737 | Active | disruptive (deny) |
| 341738 | Active | disruptive (deny) |
| 342259 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344361 | Active | disruptive (deny) |
| 344362 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344364 | Active | disruptive (deny) |
| 344365 | Active | disruptive (deny) |
| 344366 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 344372 | Active | disruptive (deny) |
| 345271 | Active | non-disruptive (pass) |
| 345493 | Active | non-disruptive (pass) |
| 346755 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 350147 | Active | disruptive (deny) |
| 350148 | Active | disruptive (deny) |
| 350591 | Active | disruptive (deny) |
| 360147 | Active | disruptive (deny) |
| 360148 | Active | disruptive (deny) |
| 360151 | Active | disruptive (deny) |
| 377360 | Active | non-disruptive (pass) |
| 380026 | Active | disruptive (deny) |
| 380122 | Active | disruptive (deny) |
| 382291 | Active | disruptive (deny) |
| 390109 | Active | disruptive (deny) |
| 390572 | Active | disruptive (deny) |
| 390616 | Active | disruptive (deny) |
| 390636 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390712 | Active | disruptive (deny) |
| 390716 | Active | disruptive (deny) |
| 390719 | Active | disruptive (deny) |
| 390722 | Active | disruptive (deny) |
| 390723 | Active | disruptive (deny) |
| 390726 | Active | disruptive (deny) |
| 390727 | Active | disruptive (deny) |
| 391213 | Active | disruptive (deny) |
| 392301 | Active | disruptive (deny) |
| 392647 | Active | disruptive (deny) |
| 392648 | Active | disruptive (deny) |
| 392767 | Active | disruptive (deny) |
| 393655 | Active | disruptive (deny) |
| 393781 | Active | disruptive (deny) |
| 398001 | Active | non-disruptive (pass) |
| 398003 | Active | disruptive (deny) |
| 398004 | Active | disruptive (deny) |
| 398008 | Active | non-disruptive (pass) |
| 398021 | Active | disruptive (deny) |
| 398022 | Active | disruptive (deny) |
| 398023 | Active | disruptive (deny) |
| 398123 | Active | disruptive (deny) |
| 398126 | Active | disruptive (deny) |
Related MITRE CAPEC Context
MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims: