On this page
Atomicorp WAF Rule 390722
Rule Summary
- Rule ID: 390722
- Status: Active
- Alert message: Atomicorp.com WAF Rules: HTTP Header Injection Attack via payload (CR/LF detected)
- Observed CWEs: CWE-20 (8), CWE-22 (4), CWE-73 (1), CWE-74 (5), CWE-77 (1), CWE-78 (5), CWE-79 (10), CWE-89 (1), CWE-93 (4), CWE-94 (4), CWE-96 (1), CWE-113 (1), CWE-200 (2), CWE-201 (1), CWE-284 (2), CWE-285 (1), CWE-287 (3), CWE-306 (2), CWE-345 (1), CWE-367 (6), CWE-441 (3), CWE-444 (1), CWE-470 (1), CWE-501 (1), CWE-502 (13), CWE-611 (1), CWE-625 (1), CWE-639 (1), CWE-749 (1), CWE-776 (1), CWE-829 (1), CWE-862 (2), CWE-918 (214), CWE-1188 (4), CWE-1336 (1), CWE-1389 (1)
- Revision: 5
- Rule severity: Critical
- Phase: 2 (request body)
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “HTTP Header Injection Attack via payload (CR/LF detected)”. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2026-33712 | TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls | typebot.io | 10.0 (v3.1) | Critical |
| CVE-2026-54745 | Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENAB | pipelines | 10.0 (v3.1) | Critical |
| CVE-2026-31818 | Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist | budibase | 9.9 (v3.1) | Critical |
| CVE-2026-34838 | Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in AbstractSettingsCollection | group-office | 9.9 (v3.1) | Critical |
| CVE-2026-43986 | Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay | Tautulli | 9.9 (v3.1) | Critical |
| CVE-2015-8103 | Jenkins-CI Unauthenticated Script-Console Scanner | openshift container platform | 9.8 (v3.1) | Critical |
| CVE-2017-12629 | Apache Solr XML External Entity Injection (CVE-2017-12629) | solr | 9.8 (v3.1) | Critical |
| CVE-2018-1000861 | Jenkins ACL Bypass and Metaprogramming RCE | jenkins | 9.8 (v3.1) | Critical |
| CVE-2018-17431 | Comodo Unified Threat Management Web Console - Remote Code Execution | unified threat management firewall | 9.8 (v3.1) | Critical |
| CVE-2019-12725 | Zeroshell 3.9.0 - Remote Command Execution | zeroshell | 9.8 (v3.0) | Critical |
| CVE-2023-25826 | OpenTSDB Arbitrary Command Injection Remote Code Execution（CVE-2023-25826） | opentsdb | 9.8 (v3.1) | Critical |
| CVE-2024-23692 | Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution | http file server | 9.8 (v3.1) | Critical |
| CVE-2025-24799 | GLPI Inventory Plugin Unauthenticated Blind Boolean SQLi | glpi | 9.8 (v3.1) | Critical |
| CVE-2025-56563 | Server-Side Request Forgery | - | 9.8 (v3.1) | Critical |
| CVE-2026-19912 | Kaltura HTML5 Video Player, html5 library Arbitrary Code Execution Vulnerability | Kaltura HTML5 Video Player, html5 library | 9.8 (v3.1) | Critical |
| CVE-2026-30118 | scalar/astro v0.1.13 was discovered to Server-Side Request Forgery Vulnerability | - | 9.8 (v3.1) | Critical |
| CVE-2026-77647 | SPIP X-Spip-Filtre Unauthenticated RCE | SPIP | 9.8 (v3.1) | Critical |
| CVE-2026-84372 | Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections | predis | 9.8 (v3.1) | Critical |
| CVE-2026-12564 | Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credenti | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | 9.6 (v3.1) | Critical |
| CVE-2026-12605 | glassfish Server-Side Request Forgery Vulnerability | glassfish | 9.6 (v3.1) | Critical |
| CVE-2026-13751 | Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load | snowflake cli | 9.6 (v3.1) | Critical |
| CVE-2026-61559 | @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery | gitlab-mcp | 9.6 (v3.1) | Critical |
| CVE-2010-20059 | FreeNAS exec_raw.php Arbitrary Command Execution | FreeNAS | 9.3 (v4.0) | Critical |
| CVE-2026-64849 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirect | mlflow | 9.3 (v3.1) | Critical |
| CVE-2026-66794 | Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route | multicluster engine for Kubernetes 2.10 | 9.3 (v3.1) | Critical |
| CVE-2026-10042 | manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model | manga-image-translator | 9.2 (v4.0) | Critical |
| CVE-2026-110628 | Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment | kan | 9.2 (v4.0) | Critical |
| CVE-2026-56266 | Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints | crawl4ai | 9.2 (v4.0) | Critical |
| CVE-2026-63306 | stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints | stoatchat | 9.2 (v4.0) | Critical |
| CVE-2026-65317 | Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass | Verba | 9.2 (v4.0) | Critical |
| CVE-2026-85614 | OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker | openpanel | 9.2 (v4.0) | Critical |
| CVE-2026-86119 | Webstudio through 0.296.0 SSRF via /cgi proxy routes | webstudio | 9.2 (v4.0) | Critical |
| CVE-2026-87930 | MaxSite CMS through 109.6 PHP Object Injection via ci_session | MaxSite CMS | 9.2 (v4.0) | Critical |
| CVE-2025-12999 | Eclipse Open VSX Insufficient Verification of Data Authenticity Vulnerability | Eclipse Open VSX | 9.1 (v4.0) | Critical |
| CVE-2026-107781 | Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById | skyeye | 9.1 (v4.0) | Critical |
| CVE-2026-13147 | WordPress Kirki < 6.0.12 - Server-Side Request Forgery | kirki | 9.1 (v3.1) | Critical |
| CVE-2026-44313 | LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function | linkwarden | 9.1 (v3.1) | Critical |
| CVE-2026-47168 | EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params | espocrm | 9.1 (v3.1) | Critical |
| CVE-2026-75332 | Zyplayer-Doc <=1.0.0 Server-Side Request Forgery Vulnerability | - | 9.1 (v3.1) | Critical |
| CVE-2026-13603 | SSRF with API key leak in pretix-oppwa | pretix-oppwa | 9.0 (v4.0) | Critical |
| CVE-2026-14602 | Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter | Remote API | 9.0 (v3.1) | Critical |
| CVE-2021-41282 | pfSense Diag Routes Web Shell Upload | pfsense | 8.8 (v3.1) | High |
| CVE-2023-2288 | Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization | otter | 8.8 (v3.1) | High |
| CVE-2026-100391 | MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation | mediaflow-proxy | 8.8 (v4.0) | High |
| CVE-2026-104464 | YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter | yeswiki | 8.8 (v4.0) | High |
| CVE-2026-57143 | PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url paramete | praisonaiagents | 8.8 (v3.1) | High |
| CVE-2026-92566 | DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview | datagear | 8.8 (v4.0) | High |
| CVE-2005-10004 | Cacti graph_view.php Remote Command Execution | cacti | 8.7 (v4.0) | High |
| CVE-2023-54402 | iDocView SSRF via /doc/upload Endpoint Hardcoded Token | iDocView | 8.7 (v4.0) | High |
| CVE-2025-71260 | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE | footprints | 8.7 (v4.0) | High |
| CVE-2026-34367 | InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.7 (v3.1) | High |
| CVE-2026-71981 | Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter | cypht | 8.7 (v4.0) | High |
| CVE-2026-81093 | Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton | actors-mcp-server | 8.7 (v4.0) | High |
| CVE-2026-82270 | Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/* | gateway | 8.7 (v4.0) | High |
| CVE-2026-82638 | jina-ai reader Server-Side Request Forgery via disabled private-address guard | reader | 8.7 (v4.0) | High |
| CVE-2026-85608 | Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter | Douyin TikTok Download API | 8.7 (v4.0) | High |
| CVE-2026-85612 | OpenPanel before 2.3.0 SSRF via favicon and og endpoints | openpanel | 8.7 (v4.0) | High |
| CVE-2026-85673 | LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding | LlamaFactory | 8.7 (v4.0) | High |
| CVE-2026-34160 | Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata ser | chamilo lms | 8.6 (v3.1) | High |
| CVE-2026-34577 | Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check | postiz | 8.6 (v3.1) | High |
| CVE-2026-77581 | BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass | bentopdf | 8.6 (v3.1) | High |
| CVE-2026-81889 | elFinder: SSRF protection bypass via DNS rebinding in the fsock_get_contents() fallback | elFinder | 8.6 (v3.1) | High |
| CVE-2026-56663 | AutoGPT: SSRF-to-RCE Chain in SendWebRequestBlock via IP validation bypass and internal pg-meta access | AutoGPT | 8.5 (v3.1) | High |
| CVE-2026-57126 | praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS | PraisonAI | 8.5 (v3.1) | High |
| CVE-2026-61640 | Wallos: SSRF via OIDC Token/UserInfo URL Configuration | Wallos | 8.5 (v4.0) | High |
| CVE-2026-67424 | Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation | flyto-core | 8.5 (v3.1) | High |
| CVE-2026-69250 | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration | flowise | 8.5 (v4.0) | High |
| CVE-2026-110255 | Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint | dockhand | 8.4 (v4.0) | High |
| CVE-2026-54507 | Vvveb oEmbedProxy vulnerable to server-side request forgery | Vvveb | 8.4 (v4.0) | High |
| CVE-2026-72855 | Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST | server | 8.4 (v4.0) | High |
| CVE-2026-104458 | YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses | yeswiki | 8.3 (v4.0) | High |
| CVE-2026-52769 | YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub Signature.keyId | yeswiki | 8.3 (v3.1) | High |
| CVE-2026-116192 | rclone from 1.37 before 1.74.2 SSRF via –rc-serve scheme-relative remote roots | rclone | 8.2 (v4.0) | High |
| CVE-2026-16268 | Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler | Newsletters | 8.2 (v3.1) | High |
| CVE-2026-43910 | Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor | java-client | 8.2 (v3.1) | High |
| CVE-2026-54691 | datamodel-code-generator vulnerable to SSRF via –url: no host/IP validation, follows redirects | datamodel-code-generator | 8.2 (v3.1) | High |
| CVE-2026-77348 | Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.ph | Wallos | 8.2 (v3.1) | High |
| CVE-2026-82262 | Logto Server-Side Request Forgery via webhook test endpoint | logto | 8.2 (v4.0) | High |
| CVE-2026-34365 | InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.1 (v3.1) | High |
| CVE-2026-34366 | InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.1 (v3.1) | High |
| CVE-2026-55864 | GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool | core-geonetwork | 7.8 (v4.0) | High |
| CVE-2026-34936 | PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback | praisonai | 7.7 (v3.1) | High |
| CVE-2026-39843 | Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching | plane | 7.7 (v3.1) | High |
| CVE-2026-42345 | FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, a | FastGPT | 7.7 (v3.1) | High |
| CVE-2026-53549 | Termix: Server-Side Request Forgery via Proxy Connectivity Test | Termix | 7.7 (v3.1) | High |
| CVE-2026-56285 | Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint | nitter | 7.7 (v4.0) | High |
| CVE-2026-61835 | Directus: SSRF Protection Bypass via 0.0.0.0 in File Import | directus | 7.7 (v3.1) | High |
| CVE-2026-63088 | stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass | stoatchat | 7.7 (v4.0) | High |
| CVE-2026-63764 | LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass | lmdeploy | 7.7 (v4.0) | High |
| CVE-2026-67346 | Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass | swarms | 7.7 (v4.0) | High |
| CVE-2026-69192 | ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trus | ip-address | 7.7 (v4.0) | High |
| CVE-2026-75888 | Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch | Red Hat OpenShift Container Platform 4.14 | 7.7 (v3.1) | High |
| CVE-2026-76898 | draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js | drawio | 7.7 (v4.0) | High |
| CVE-2026-77775 | Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation | Headroom | 7.7 (v4.0) | High |
| CVE-2026-79764 | Termix: Authenticated SSRF via /homepage/proxy — No Destination Allowlist | Termix | 7.7 (v3.1) | High |
| CVE-2026-93872 | Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter | Cotonti | 7.7 (v4.0) | High |
| CVE-2026-105628 | Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint | plane | 7.6 (v3.1) | High |
| CVE-2026-55177 | CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guar | CloudTAK | 7.6 (v4.0) | High |
| CVE-2026-55232 | Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy | Vvveb | 7.6 (v3.1) | High |
| CVE-2026-79749 | MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation | mcphub | 7.6 (v4.0) | High |
| CVE-2012-4869 | FreePBX 2.10.0 / 2.9.0 callmenum Remote Code Execution | freepbx | 7.5 (v2.0) | High |
| CVE-2015-1592 | SixApart MovableType Storable Perl Code Execution | debian linux | 7.5 (v2.0) | High |
| CVE-2019-17558 | Apache Solr Remote Code Execution via Velocity Template | solr | 7.5 (v3.1) | High |
| CVE-2022-0666 | Microweber < 1.2.11 - CRLF Injection | microweber | 7.5 (v3.1) | High |
| CVE-2023-48241 | XWiki < 4.10.15 - Information Disclosure | xwiki | 7.5 (v3.1) | High |
| CVE-2025-59527 | FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability | flowise | 7.5 (v3.1) | High |
| CVE-2025-61884 | Oracle E-Business Suite - Server-Side Request Forgery | configurator | 7.5 (v3.1) | High |
| CVE-2025-63951 | phoniebox Unsafe Deserialization Vulnerability | phoniebox | 7.5 (v3.1) | High |
| CVE-2026-19913 | Kaltura HTML5 Video Player, html5lib library Improper Input Validation Vulnerability | Kaltura HTML5 Video Player, html5lib library | 7.5 (v3.1) | High |
| CVE-2026-22777 | ComfyUI-Manager CRLF Injection in Configuration Handler (CVE-2026-22777) | comfyui-manager | 7.5 (v3.1) | High |
| CVE-2026-24138 | FOG vulnerable to unauthenticated SSRF via /fog/service/getversion.php | fogproject | 7.5 (v3.1) | High |
| CVE-2026-35036 | Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature | ech0 | 7.5 (v3.1) | High |
| CVE-2026-95265 | Feehi CMS 2.1.1 Server-Side Request Forgery Vulnerability | Feehi CMS 2.1.1 | 7.5 (v3.1) | High |
| CVE-2026-45310 | CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Tool | CodeWhale | 7.4 (v3.1) | High |
| CVE-2025-45869 | LogicalDOC Enterprise Version up to and before v9.1.1 Server-Side Request Forgery Vulnerability | - | 7.3 (v3.1) | High |
| CVE-2020-16205 | Geutebruck testaction.cgi Remote Command Execution | g-cam ebc-2110 firmware | 7.2 (v3.1) | High |
| CVE-2026-114730 | Webmail Server-Side Request Forgery Vulnerability | Webmail | 7.2 (v3.1) | High |
| CVE-2026-107362 | Server-Side Request Forgery in Malcolm | Malcolm | 7.1 (v3.1) | High |
| CVE-2026-22664 | prompts.chat SSRF via Fal.ai Media Status Polling | prompts.chat | 7.1 (v4.0) | High |
| CVE-2026-54077 | ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users | arcadedb | 7.1 (v3.1) | High |
| CVE-2026-57303 | assembla Server-Side Request Forgery Vulnerability | assembla | 7.1 (v3.1) | High |
| CVE-2026-75844 | ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass | arcadedb | 7.1 (v4.0) | High |
| CVE-2026-79747 | MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy | mcphub | 7.1 (v3.1) | High |
| CVE-2026-85164 | WWBN AVideo Server-Side Request Forgery via set_api_userImages | AVideo | 7.1 (v4.0) | High |
| CVE-2026-92804 | Nango through 0.70.4 Server-Side Request Forgery via Configuration | Nango | 7.1 (v4.0) | High |
| CVE-2026-96651 | Plex Media Server path traversal | media server | 7.1 (v4.0) | High |
| CVE-2026-10107 | MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint | MoviePilot | 7.0 (v4.0) | High |
| CVE-2026-101898 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls | axios | 7.0 (v4.0) | High |
| CVE-2025-11864 | NucleoidAI Nucleoid Outbound Request cluster.ts extension.apply server-side request forgery | Nucleoid | 6.9 (v4.0) | Medium |
| CVE-2025-34282 | ThingsBoard < v4.2.1 SVG Image SSRF | thingsboard | 6.9 (v4.0) | Medium |
| CVE-2025-71257 | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass | footprints itsm | 6.9 (v4.0) | Medium |
| CVE-2026-100601 | ClawHub SSRF via Unchecked DNS Resolution in Profile Image | clawhub | 6.9 (v4.0) | Medium |
| CVE-2026-104440 | YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter | yeswiki | 6.9 (v4.0) | Medium |
| CVE-2026-104441 | YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action | yeswiki | 6.9 (v4.0) | Medium |
| CVE-2026-104442 | YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action | yeswiki | 6.9 (v4.0) | Medium |
| CVE-2026-108850 | Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup | company-research-agent | 6.9 (v4.0) | Medium |
| CVE-2026-110222 | Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup | IFSC | 6.9 (v4.0) | Medium |
| CVE-2026-111662 | Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint | chaskiq | 6.9 (v4.0) | Medium |
| CVE-2026-111720 | fish-island-backend through commit 7c61b78 SSRF via /api/web/parse | fish-island-backend | 6.9 (v4.0) | Medium |
| CVE-2026-112267 | SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker | sglang | 6.9 (v4.0) | Medium |
| CVE-2026-116205 | YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax | yeswiki | 6.9 (v4.0) | Medium |
| CVE-2026-34964 | Adminer before 5.5.0 SSRF via PDO DSN Injection | adminer | 6.9 (v4.0) | Medium |
| CVE-2026-44652 | SillyTavern: SSRF vulnerability in the CORS proxy middleware | SillyTavern | 6.9 (v4.0) | Medium |
| CVE-2026-54885 | Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching | boruta | 6.9 (v4.0) | Medium |
| CVE-2026-59809 | SiYuan before v3.8.0 Secret Exfiltration via http_request URL | siyuan | 6.9 (v4.0) | Medium |
| CVE-2026-61793 | Nuxt OG Image has unauthenticated SSRF via fonts[].path URL parameter | og-image | 6.9 (v4.0) | Medium |
| CVE-2026-63096 | Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint | dendrite | 6.9 (v4.0) | Medium |
| CVE-2026-73058 | stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass | stoatchat | 6.9 (v4.0) | Medium |
| CVE-2026-81678 | AVideo SSRF Guard Bypass via IPv6 Transition Addresses | AVideo | 6.9 (v4.0) | Medium |
| CVE-2026-85609 | Openpanel before 2.3.0 SSRF via Site Checker Endpoint | openpanel | 6.9 (v4.0) | Medium |
| CVE-2026-86806 | opengeos GeoLibre _is_within_roots server-side request forgery | GeoLibre | 6.9 (v4.0) | Medium |
| CVE-2026-8712 | Wyoming < 1.10.2 SSRF via uri Query Parameter | wyoming | 6.9 (v4.0) | Medium |
| CVE-2026-91081 | Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint | docs | 6.9 (v4.0) | Medium |
| CVE-2026-91966 | AVideo through 29.0 Unauthenticated SSRF via Host Header | AVideo | 6.9 (v4.0) | Medium |
| CVE-2026-97865 | Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization | Open-Web-Analytics | 6.9 (v4.0) | Medium |
| CVE-2026-102354 | BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker | bentopdf | 6.8 (v3.1) | Medium |
| CVE-2026-63334 | draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist | drawio | 6.8 (v3.1) | Medium |
| CVE-2021-31249 | CHIYU TCP/IP Converter - Carriage Return Line Feed Injection | bf-430 firmware | 6.5 (v3.1) | Medium |
| CVE-2024-34319 | Server-Side Request Forgery | - | 6.5 (v3.1) | Medium |
| CVE-2025-32815 | NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials | netmri | 6.5 (v3.1) | Medium |
| CVE-2025-50234 | mccms Arbitrary Code Execution Vulnerability | mccms | 6.5 (v3.1) | Medium |
| CVE-2026-115886 | MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI e | mlflow | 6.5 (v3.1) | Medium |
| CVE-2026-15974 | sglang Server-Side Request Forgery Vulnerability | sglang | 6.5 (v3.1) | Medium |
| CVE-2026-62282 | OpenCVE: Server-Side Request Forgery (SSRF) in notifications | opencve | 6.5 (v3.1) | Medium |
| CVE-2026-88403 | nocobase v2.1.21 Server-Side Request Forgery Vulnerability | nocobase v2.1.21 | 6.5 (v3.1) | Medium |
| CVE-2026-79760 | Termix: Authenticated blind SSRF through notification channel test endpoints | Termix | 6.4 (v3.1) | Medium |
| CVE-2025-7825 | Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation | Schema Plugin For Divi, Gutenberg & Shortcodes | 6.3 (v3.1) | Medium |
| CVE-2026-102983 | Astro: Netlify Image CDN allowlist bypass enables SSRF | astro | 6.3 (v4.0) | Medium |
| CVE-2026-110652 | ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass | DocumentServer | 6.3 (v4.0) | Medium |
| CVE-2026-111171 | Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass | web3.py | 6.3 (v4.0) | Medium |
| CVE-2026-42335 | MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy | MaxKB | 6.3 (v4.0) | Medium |
| CVE-2026-42344 | FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints | FastGPT | 6.3 (v3.1) | Medium |
| CVE-2026-54020 | Open WebUI: DNS Rebinding SSRF Bypass | open webui | 6.3 (v3.1) | Medium |
| CVE-2026-56769 | Huly Platform - Server-Side Request Forgery via /import Endpoint | platform | 6.3 (v4.0) | Medium |
| CVE-2026-56771 | NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint | NewsBlur | 6.3 (v4.0) | Medium |
| CVE-2026-63107 | LimeSurvey SSRF via REST API Survey Template Host Header | LimeSurvey | 6.3 (v4.0) | Medium |
| CVE-2026-67620 | Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List | flowise | 6.3 (v4.0) | Medium |
| CVE-2026-73530 | Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip() | flyto-core | 6.3 (v4.0) | Medium |
| CVE-2026-82044 | UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf | UTMStack | 6.3 (v4.0) | Medium |
| CVE-2026-85738 | TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4) | TREK | 6.3 (v3.1) | Medium |
| CVE-2026-91079 | Huly Platform through 0.7.426 SSRF via Print Service | platform | 6.3 (v4.0) | Medium |
| CVE-2018-16979 | Monstra CMS 3.0.4 - HTTP Header Injection | monstra | 6.1 (v3.0) | Medium |
| CVE-2019-11507 | Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected) | connect secure | 6.1 (v3.1) | Medium |
| CVE-2020-13483 | Bitrix24 <=20.0.0 - Cross-Site Scripting | bitrix24 | 6.1 (v3.1) | Medium |
| CVE-2021-24235 | WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting | goto | 6.1 (v3.1) | Medium |
| CVE-2021-25161 | Aruba Instant Access Point (IAP) - Cross-Site Scripting | aruba-instant-access-point | 6.1 (v3.1) | Medium |
| CVE-2021-43810 | Admidio - Cross-Site Scripting | admidio | 6.1 (v3.1) | Medium |
| CVE-2023-24488 | Citrix Gateway and Citrix ADC - Cross-Site Scripting | gateway | 6.1 (v3.1) | Medium |
| CVE-2023-38501 | CopyParty v1.8.6 - Cross Site Scripting | copyparty | 6.1 (v3.1) | Medium |
| CVE-2023-5558 | LearnPress < 4.2.5.5 - Cross-Site Scripting | learnpress | 6.1 (v3.1) | Medium |
| CVE-2025-13439 | Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserializatio | Fancy Product Designer | 5.9 (v3.1) | Medium |
| CVE-2025-11427 | WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery | WP Migrate Lite – Migration Made Easy | 5.8 (v3.1) | Medium |
| CVE-2026-10526 | EmbedPress < 4.6.1 - Unauthenticated Blind SSRF | EmbedPress | 5.8 (v3.1) | Medium |
| CVE-2026-34981 | whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3 | whisperx rest api | 5.8 (v3.1) | Medium |
| CVE-2026-45709 | Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filte | mailpit | 5.8 (v3.1) | Medium |
| CVE-2026-47160 | Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass | vaultwarden | 5.8 (v3.1) | Medium |
| CVE-2026-48053 | Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset | kolibri | 5.8 (v3.1) | Medium |
| CVE-2026-55187 | Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) | mailpit | 5.8 (v3.1) | Medium |
| CVE-2026-73243 | kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass | kkFileView | 5.8 (v3.1) | Medium |
| CVE-2025-14528 | D-Link DIR-803 - Authentication Bypass | dir-803 firmware | 5.5 (v4.0) | Medium |
| CVE-2026-100893 | Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery | VoceChat Server | 5.5 (v4.0) | Medium |
| CVE-2026-100901 | athlon1600 youtube-downloader stream.php stream server-side request forgery | youtube-downloader | 5.5 (v4.0) | Medium |
| CVE-2026-100909 | OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery | the file modules/system/classes/ResizeImages.php | 5.5 (v4.0) | Medium |
| CVE-2026-101005 | October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery | October CMS | 5.5 (v4.0) | Medium |
| CVE-2026-105290 | feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery | feelcrm-os | 5.5 (v4.0) | Medium |
| CVE-2026-18973 | heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery | super-agent-party | 5.5 (v4.0) | Medium |
| CVE-2026-19753 | Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery | mcp-rdf-explorer | 5.5 (v4.0) | Medium |
| CVE-2026-7178 | ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery | nextchat | 5.5 (v4.0) | Medium |
| CVE-2026-7221 | TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery | CloudBase-MCP | 5.5 (v4.0) | Medium |
| CVE-2026-76795 | AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery | PullMD | 5.5 (v4.0) | Medium |
| CVE-2026-82801 | NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery | earthdata-search | 5.5 (v4.0) | Medium |
| CVE-2026-85380 | light0011 cms UEditor controller.php catchimage server-side request forgery | cms | 5.5 (v4.0) | Medium |
| CVE-2026-94038 | NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery | dim-sum-app | 5.5 (v4.0) | Medium |
| CVE-2026-114620 | Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF | authlib | 5.4 (v3.1) | Medium |
| CVE-2026-48483 | TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server | typebot.io | 5.4 (v3.1) | Medium |
| CVE-2026-7798 | FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter | FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | 5.4 (v3.1) | Medium |
| CVE-2024-33113 | D-LINK DIR-845L bsc_sms_inbox.php file - Information Disclosure | dir-845l | 5.3 (v3.1) | Medium |
| CVE-2026-110254 | Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory | dockhand | 5.3 (v4.0) | Medium |
| CVE-2026-115411 | crawlseo before 0.2.4 Server-Side Request Forgery via Crawler | crawlseo | 5.3 (v4.0) | Medium |
| CVE-2026-16536 | Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id | Simple Google Calendar Outlook Events Widget | 5.3 (v3.1) | Medium |
| CVE-2026-44202 | OpenAM Authenticated Server-Side Request Forgery (SSRF) via /sessionservice | OpenAM | 5.3 (v4.0) | Medium |
| CVE-2026-44583 | Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module | Paymenter | 5.3 (v3.1) | Medium |
| CVE-2026-49138 | Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following | nanobot | 5.3 (v4.0) | Medium |
| CVE-2026-49345 | Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF) | mercator | 5.3 (v4.0) | Medium |
| CVE-2026-54300 | @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config | astro | 5.3 (v3.1) | Medium |
| CVE-2026-54508 | TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution | TREK | 5.3 (v4.0) | Medium |
| CVE-2026-59231 | Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs | Pentestify | 5.3 (v4.0) | Medium |
| CVE-2026-63730 | HyperDX < 2.31.0 SSRF via Webhook Test Endpoint | hyperdx | 5.3 (v4.0) | Medium |
| CVE-2026-64626 | AVideo Encoder downloadURL SSRF via unpinned retry fallback | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-74858 | jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery | fetcher-mcp | 5.3 (v4.0) | Medium |
| CVE-2026-78231 | Gitea blind SSRF through OpenID assertion verification | Gitea | 5.3 (v3.1) | Medium |
| CVE-2026-92569 | Hippo4j through 1.5.0 SSRF via clientAddress Parameter | hippo4j | 5.3 (v4.0) | Medium |
| CVE-2026-93597 | ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses | arcadedb | 5.3 (v4.0) | Medium |
| CVE-2026-96652 | Plex Media Server SSRF | media server | 5.3 (v4.0) | Medium |
| CVE-2026-96655 | Plex Media Server arbitrary-host SSRF | media server | 5.3 (v4.0) | Medium |
| CVE-2026-105263 | Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery | Shaarli | 5.1 (v4.0) | Medium |
| CVE-2026-110225 | Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route | Shaarli | 5.1 (v4.0) | Medium |
| CVE-2026-42336 | MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch | MaxKB | 5.1 (v4.0) | Medium |
| CVE-2015-5285 | Kallithea 0.2.9 - 'came_from' HTTP Response Splitting | kallithea | 5.0 (v2.0) | Medium |
| CVE-2025-11536 | Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery | Element Pack – Widgets, Templates & Addons for Elementor | 5.0 (v3.1) | Medium |
| CVE-2026-78850 | Matomo v.5.11.2 Information Disclosure Vulnerability | - | 5.0 (v3.1) | Medium |
| CVE-2026-114718 | Webmail Cross-Site Scripting Vulnerability | Webmail | 4.7 (v3.1) | Medium |
| CVE-2026-113671 | ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated S | apostrophe | 4.3 (v3.1) | Medium |
| CVE-2025-10583 | WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forge | WP Fastest Cache Premium | 3.5 (v3.1) | Low |
| CVE-2026-49262 | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy | pagible | 3.0 (v3.1) | Low |
| CVE-2026-68927 | MobSF: SSRF port restriction bypass in assetlinks_check | Mobile-Security-Framework-MobSF | 3.0 (v3.1) | Low |
| CVE-2026-90575 | PHPGurukul Small CRM Login Success login.php unserialize deserialization | Small CRM | 2.9 (v4.0) | Low |
| CVE-2026-115730 | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl | i18next-http-backend | 2.3 (v4.0) | Low |
| CVE-2026-115752 | Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon | signalk-server | 2.3 (v4.0) | Low |
| CVE-2026-73087 | Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher | dozzle | 2.3 (v4.0) | Low |
| CVE-2025-13174 | rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery | WeRSS we-mp-rss | 2.1 (v4.0) | Low |
| CVE-2025-14518 | PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgery | powerjob | 2.1 (v4.0) | Low |
| CVE-2026-102244 | MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery | SurfSense | 2.1 (v4.0) | Low |
| CVE-2026-10239 | JeecgBoot edit WordUtil.addImage server-side request forgery | JeecgBoot | 2.1 (v4.0) | Low |
| CVE-2026-109402 | conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery | conductor | 2.1 (v4.0) | Low |
| CVE-2026-112254 | agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery | clientst0r | 2.1 (v4.0) | Low |
| CVE-2026-116224 | fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery | benotes | 2.1 (v4.0) | Low |
| CVE-2026-12210 | universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery | python-utcp | 2.1 (v4.0) | Low |
| CVE-2026-15500 | AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery | AstrBot | 2.1 (v4.0) | Low |
| CVE-2026-15619 | mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery | clawlet | 2.1 (v4.0) | Low |
| CVE-2026-15620 | mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery | clawlet | 2.1 (v4.0) | Low |
| CVE-2026-15628 | zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery | chatgpt-on-wechat CowAgent | 2.1 (v4.0) | Low |
| CVE-2026-16194 | zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery | CowAgent | 2.1 (v4.0) | Low |
| CVE-2026-17458 | mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery | openclaw-cn | 2.1 (v4.0) | Low |
| CVE-2026-19927 | OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery | OpenBoxes | 2.1 (v4.0) | Low |
| CVE-2026-5803 | bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgery | openai-realtime-ui | 2.1 (v4.0) | Low |
| CVE-2026-74842 | Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery | PromptShopMCP | 2.1 (v4.0) | Low |
| CVE-2026-8081 | router-for-me CLIProxyAPI api_tools.go server-side request forgery | cliproxyapi | 2.1 (v4.0) | Low |
| CVE-2026-83744 | invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery | Invoice Ninja | 2.1 (v4.0) | Low |
| CVE-2026-92527 | chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery | chatwoot | 2.1 (v4.0) | Low |
| CVE-2025-14116 | xerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery | Yuxi-Know | 2.0 (v4.0) | Low |
| CVE-2025-15414 | go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery | sonic | 2.0 (v4.0) | Low |
| CVE-2026-18856 | Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery | Rhymix CMS | 2.0 (v4.0) | Low |
| CVE-2026-86240 | liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery | FeehiCMS | 2.0 (v4.0) | Low |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.