Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:918"
689 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2025-34282 |
medium | 6.9 | 0.0182 | 2025-10-17 | ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashb | |
CVE-2026-0932 |
medium | 6.9 | 0.0020 | 2026-04-01 | Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-a | |
CVE-2026-5131 |
medium | 6.9 | 0.0043 | 2026-04-17 | GREENmod uses named pipes for communication between plugins, the web portal, and the system service, | |
CVE-2026-49129 |
medium | 6.9 | 0.0028 | 2026-05-28 | Music Player Daemon (MPD) before version 0.24.11 contains a server-side request forgery vulnerabilit | |
CVE-2026-46683 |
medium | 6.9 | 0.0025 | 2026-06-10 | Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Pr | |
CVE-2026-55791 |
medium | 6.9 | 0.0046 | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5. | |
CVE-2026-59101 |
medium | 6.9 | 0.0050 | 2026-07-02 | AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows una | |
CVE-2026-60091 |
medium | 6.9 | 0.0030 | 2026-07-10 | PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the | |
CVE-2026-57575 |
medium | 6.9 | 0.0060 | 2026-07-10 | Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a Se | |
CVE-2026-15746 |
medium | 6.9 | 0.0042 | 2026-07-15 | Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-t | |
CVE-2026-63086 |
medium | 6.9 | 0.0043 | 2026-07-16 | text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability | |
CVE-2026-63096 |
medium | 6.9 | 0.0034 | 2026-07-17 | Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthentic | |
CVE-2026-54272 |
medium | 6.9 | 0.0040 | 2026-07-27 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions | |
CVE-2026-54885 |
medium | 6.9 | 0.0047 | 2026-07-30 | Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attac | |
CVE-2026-69198 |
medium | 6.9 | 0.0048 | 2026-08-03 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10. | |
CVE-2026-72784 |
medium | 6.9 | 0.0024 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a server-side r | |
CVE-2026-73297 |
medium | 6.9 | 0.0290 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t | |
CVE-2026-74905 |
medium | 6.9 | 0.0039 | 2026-08-18 | SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP | |
CVE-2026-85609 |
medium | 6.9 | 0.0050 | 2026-09-04 | Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vuln | |
CVE-2026-114062 |
medium | 6.9 | 0.0035 | 2026-10-21 | SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attac | |
CVE-2026-115813 |
medium | 6.9 | 0.0036 | 2026-10-23 | Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1 | |
CVE-2026-116000 |
medium | 6.9 | 0.0029 | 2026-10-25 | A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the | |
CVE-2026-116069 |
medium | 6.9 | 0.0026 | 2026-10-25 | NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that all | |
CVE-2026-116205 |
medium | 6.9 | 0.0051 | 2026-10-25 | YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allo | |
CVE-2026-116256 |
medium | 6.9 | 0.0035 | 2026-10-26 | A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affect | |
CVE-2026-115700 |
medium | 6.9 | 0.0014 | 2026-10-26 | Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request F | |
CVE-2026-119122 |
medium | 6.9 | — | 2026-10-29 | Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker serve | |
CVE-2026-33990 |
medium | 6.8 | 0.0026 | 2026-04-01 | Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Prior | |
CVE-2026-24234 |
medium | 6.8 | 0.0015 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions, w | |
CVE-2026-65923 |
medium | 6.8 | 0.0035 | 2026-07-27 | A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under | |
CVE-2026-18378 |
medium | 6.8 | 0.0046 | 2026-07-30 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resourc | |
CVE-2026-18382 |
medium | 6.8 | 0.0052 | 2026-07-30 | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resourc | |
CVE-2026-34515 |
medium | 6.6 | 0.0045 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 | |
CVE-2026-44439 |
medium | 6.6 | 0.0040 | 2026-05-13 | PlaywrightCapture is a simple replacement for splash using playwright. Prior to 1.39.6, PlaywrightCa | |
CVE-2026-48916 |
medium | 6.6 | 0.0027 | 2026-05-27 | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals. | |
CVE-2025-60319 |
medium | 6.5 | 0.0026 | 2025-10-30 | PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization chec | |
CVE-2026-62902 |
medium | 6.5 | 0.0087 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to | |
CVE-2024-34319 |
medium | 6.5 | 0.0027 | 2026-10-13 | A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3. | |
CVE-2026-116686 |
medium | 6.5 | 0.0034 | 2026-10-27 | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers | |
CVE-2026-58639 |
medium | 6.5 | 0.0091 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to p | |
CVE-2026-55051 |
medium | 6.5 | 0.0091 | 2026-07-14 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to d | |
CVE-2026-57987 |
medium | 6.5 | 0.0087 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
CVE-2026-65813 |
medium | 6.5 | 0.0094 | 2026-08-11 | Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to ele | |
CVE-2026-70259 |
medium | 6.5 | 0.0092 | 2026-10-13 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to d | |
CVE-2026-96204 |
medium | 6.5 | 0.0078 | 2026-10-13 | Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges | |
CVE-2026-40150 |
medium | 6.5 | 0.0027 | 2026-04-09 | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praison | |
CVE-2026-31941 |
medium | 6.5 | 0.0023 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a | |
CVE-2026-40242 |
medium | 6.5 | 0.0062 | 2026-04-10 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17. | |
CVE-2026-41060 |
medium | 6.5 | 0.0030 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` func | |
CVE-2026-3340 |
medium | 6.5 | 0.0017 | 2026-04-30 | IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery ( |