CWE-918

Twenty is an open source CRM. Prior to version 1.18, the SSRF protection in SecureHttpClientService validated request UR

Frappe is a full-stack web application framework. Prior to 14.100.1, 15.100.0, and 16.6.0, a malicious user could send a

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versi

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to version 0.16.3,

WWBN AVideo is an open source video platform. Prior to version 26.0, the BulkEmbed plugin's save endpoint (`plugin/BulkE

Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal Canvas allows Server Side Request Forgery.This issue a

Lychee is a free, open-source photo-management tool. The patch introduced for GHSA-cpgw-wgf3-xc6v (SSRF via `Photo::from

OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows aut

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, LinkRepository::update and CheckLinksCommand:

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPre

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, sandbox network protection can be bypa

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to t

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by

A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows aut

Incus is an open source container and virtual machine manager. In versions prior to 7.0.0, the image import flow issues

Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a Requ

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in browser CDP profile creation that skip

mosparo is the modern solution to protect your online forms from spam. Prior to 1.4.13, the automatic rule package sourc

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.106.0 and 16.16.0, a malicious user cou

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSS

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTION-based p

Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0, PDFService._markdo

Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.10, the URL checking

Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows re

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information ov

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import funct

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpo

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or c

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the serve

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vdl=<post_id>` on any

A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (

The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to ax

The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any addres

Server-Side Request Forgery (SSRF) vulnerability in minnur External Media external-media allows Server Side Request Forg

Server-Side Request Forgery (SSRF) vulnerability in Marco Milesi ANAC XML Viewer anac-xml-viewer allows Server Side Requ

Server-Side Request Forgery (SSRF) vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.Thi

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a blind Server-Side Request Forgery

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.150, 25.0.82, a

Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.

Server-Side Request Forgery (SSRF) vulnerability in Andy Fragen Embed PDF Viewer embed-pdf-viewer allows Server Side Req

Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7

Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content nelio-content allows Server Side Reques

Xibo is an open source digital signage platform with a web content management system and Windows display player software

Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CVE-2023-27577 restric