CVE-2022-0870

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.5...

CVE-2022-0766

Server-Side Request Forgery SSRF in GitHub repository janeczku/calibre-web prior to 0.6.17...

CVE-2022-0425

A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery SSRF attacks...

CVE-2022-0132

peertube is vulnerable to Server-Side Request Forgery SSRF...

CVE-2023-49799

nuxt-api-party is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression ^https?://, however this regular expression can be bypassed by ...

CVE-2023-49159

Server-Side Request Forgery SSRF vulnerability in Elegant Digital Solutions CommentLuv.This issue affects CommentLuv: from n/a through 3.0.4...

CVE-2023-40017

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint /proxy/?url= does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and...

CVE-2022-38342

Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity XXE vulnerability which allows authenticated attackers to perform data exfiltration or Server-Side Request Forgery SSRF attacks...

CVE-2022-23644

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The...

CVE-2022-31188

CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a Server-side request forgery SSRF vulnerability. Validation has been added to urls used in the affected code path in version 2.0.0. Users are advised to...

CVE-2022-31196

Databasir is a database metadata management platform. Databasir = 1.06 has Server-Side Request Forgery SSRF vulnerability. The SSRF is triggered by a sending a single HTTP POST request to create a databaseType. By supplying a jdbcDriverFileUrl that returns a non 200 response code, the url is...

CVE-2022-0768

Server-Side Request Forgery SSRF in GitHub repository rudloff/alltube prior to 3.0.2...

CVE-2022-0086

uppy is vulnerable to Server-Side Request Forgery SSRF...

CVE-2024-39687

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the @id or other resources present within the activity it has...

Exploit for CVE-2025-45955

CVE-2025-45955 🕳️ Server-Side Request Forgery in DonWeb Ferozo...

@buttery/studio (>=0.2.3, <=0.3.7), @c0va23/react-router-dev (>=7.8.3-alpha.1, <=7.8.3-alpha.2) +18 more potentially affected by CVE-2025-61686 via @react-router/node (>=7.0.0, <=7.9.3-pre.0)

@react-router/node NPM version =7.0.0, =0.2.3, =7.8.3-alpha.1, =0.1.0, =0.0.1-dev.8, =0.0.1-0, =0.0.1-alpha.6, =3.8.8, =7.0.0-pre.0, =7.0.0-pre.0, =7.0.0-pre.0, =0.0.1-alpha.23, =0.0.1, =0.1.0-xyd.22, =0.1.0-xyd.20, =0.1.0-xyd.29 and more Source cves: CVE-2025-61686 Source advisory:...

@buttery/tokens (>=0.1.2, <=0.1.10), @common-stack/frontend-stack-react (>=6.0.6-alpha.23, <=10.0.1-alpha.0) +19 more potentially affected by CVE-2025-61686 via @remix-run/node (>=2.0.0, <=2.17.1)

@remix-run/node NPM version =2.0.0, =0.1.2, =6.0.6-alpha.23, =6.0.6-alpha.28, =2.9.1-dario-6, =0.1.0, =5.6.0, =5.13.0, =5.6.0, =5.6.0, =0.0.1-alpha.0, =2.0.0-pre.0, =2.2.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.0.0-pre.0, =2.17.1 and more Source cves: CVE-2025-61686 Source advisory:...

CVE-2026-22245 Mastodon has SSRF Protection bypass

Mastodon is a free, open-source social network server based on ActivityPub. By nature, Mastodon performs a lot of outbound requests to user-provided domains. Mastodon, however, has some protection mechanism to disallow requests to local IP addresses unless specified in ALLOWEDPRIVATEADDRESSES to...

CVE-2026-21885 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources

Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint GET /proxy/encodedDigest/encodedURL can be abused to perform Server-Side Request Forgery SSRF. An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs...

CVE-2026-21885 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources

Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint GET /proxy/encodedDigest/encodedURL can be abused to perform Server-Side Request Forgery SSRF. An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs...