CWE-918: Server-side request forgery (SSRF)
4,055 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 26 of them as exploited in the wild.
- Published CVEs
- 4,055
- Last 12 months
- 2,227
- Critical
- 472
- Known exploited
- 26
Critical 472High 1,334Medium 2,081Low 163Not scored 5
CVEs per yearBy the year they were published
- 201915
- 20202
- 20201
- 20201
- 2023213
- 20241
- 2025414
- 20262,056
- 2026536
- 2026247
- 2026181
- 2026159
Known exploitedNewest addition to KEV first
- CVE-2026-96655
Plex Media Server arbitrary-host SSRF
Plex · Media Server
ExploitedMedium5.3 - CVE-2026-96652
Plex Media Server SSRF
Plex · Media Server
ExploitedMedium5.3 - CVE-2026-83548
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote…
SonicWall · SMA1000
ExploitedCritical10.0 - CVE-2026-49869
Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`
kestra-io · kestra
ExploitedCritical10.0 - CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
mlflow · mlflow
ExploitedCritical9.3 - CVE-2026-15409
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could…
SonicWall · SMA1000
ExploitedCritical10.0 - CVE-2026-20230
Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
Cisco · Cisco Unified Communications Manager
ExploitedHigh8.6 - CVE-2021-22054
VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an…
VMware Workspace ONE UEM console
ExploitedHigh7.5 - CVE-2021-22175
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5…
GitLab · GitLab
ExploitedMedium6.8 - CVE-2020-7796
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.
Product not named
ExploitedCritical9.8
Newest CVEs
- CVE-2026-122008
Oqtane Framework before 10.3.0 SSRF via File Upload From URL
oqtane · oqtane.framework
Medium5.3 - CVE-2026-121936
easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API
cosin2077 · easyVoice
Medium6.9 - CVE-2026-111036
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Coupa · Coupa Total Spend Management Platform
High8.4 - CVE-2026-118422
Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path
Unknown · Stape Conversion Tracking
High7.1 - CVE-2026-110692
PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import
Unknown · PowerPack Addons for Elementor: Widgets, Form Styler and Templates
Medium4.1 - CVE-2026-118628
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
MLflow · MLflow
High8.2 - CVE-2026-121581
ArcReel Provider Test-Connection Endpoint test server-side request forgery
ArcReel
Medium5.3 - CVE-2026-120715
Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged…
Devolutions · Server
Not scored - CVE-2026-121580
Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to…
Devolutions · Server
Not scored - CVE-2026-105822
Server-Side Request Forgery in Tapo Cloud MQTT Proxy
TP-Link Systems Inc. · Tapo Cloud Service
High8.3