By weakness (CWE)

CWE-918: related vulnerabilities

CVEs classified under CWE-918. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

113 published vulnerabilities · page 2 of 2

• CVE-2026-45502MEDIUM 5.0

  A server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server allows an authenticated attacker to make the server issue requests on their behalf, potentially exposing sensitive network information. An attacker with valid credentials can craft requests that cause the Exchange server to connect to internal resources and leak data back to them. This requires prior authentication but poses a meaningful information disclosure risk within trusted network boundaries.

• CVE-2026-46526MEDIUM 5.0

  Local Deep Research versions before 1.6.10 contain a Server-Side Request Forgery (SSRF) vulnerability caused by inconsistent URL validation logic. The application attempts to block malicious URLs using one parsing method but actually sends requests using a different method, creating a gap that attackers can exploit. An authenticated user can craft a specially formatted URL that passes the security checks but reaches an unintended internal or restricted server when the request is actually sent.

• CVE-2026-46561MEDIUM 5.0

  pyLoad, a popular open-source download manager, contains a vulnerability that allows authenticated users to bypass security controls designed to prevent access to internal networks. Specifically, an attacker can craft a specially designed URL that initially appears safe but redirects to a private IP address after the security check passes. This lets the attacker potentially access or interact with systems on the internal network that should be off-limits. The issue affects versions prior to 0.5.0b3.dev100 and has been resolved in that release.

• CVE-2026-49138MEDIUM 5.0

  Nanobot versions prior to 0.2.1 contain a server-side request forgery (SSRF) vulnerability in its web_fetch tool. An attacker with login credentials can trick the application into making requests to internal or private network systems by providing a URL that redirects to a loopback address (like 127.0.0.1) or private IP range. The vulnerability exploits how the underlying httpx library automatically follows HTTP redirects—the application validates the initial URL but not the final destination after redirects are followed, allowing attackers to reach internal services that should not be accessible from the internet.

• CVE-2026-10583MEDIUM 4.7

  A server-side request forgery (SSRF) vulnerability exists in nextlevelbuilder GoClaw versions up to 3.11.3. The flaw is located in the TTS Configuration Endpoint's Import function, which fails to properly validate or restrict outbound HTTP requests. An authenticated attacker with high privileges can exploit this to make the affected server initiate requests to internal or external systems on their behalf, potentially accessing sensitive internal resources or launching further attacks. The vulnerability has been publicly disclosed.

• CVE-2026-11469MEDIUM 4.7

  A vulnerability exists in jishenghua jshERP versions up to 3.6 that allows an authenticated administrator to perform server-side request forgery (SSRF) attacks by manipulating configuration parameters. An attacker with high-level privileges can craft malicious input to the platformConfig add endpoint, causing the server to make unintended requests to internal or external systems. This vulnerability requires authentication and administrative access to exploit, limiting immediate risk but potentially enabling lateral movement or data exfiltration once an admin account is compromised.

• CVE-2026-45366MEDIUM 4.7

  The @utcp/http package in typescript-utcp contains a blind Server-Side Request Forgery (SSRF) vulnerability that allows an attacker to trick the software into making requests to internal services. The flaw stems from inconsistent validation: while manual URL registration checks that URLs are HTTPS or localhost, the tool invocation pathway skips this validation and directly uses URLs from attacker-controlled OpenAPI specifications. An attacker can host a malicious OpenAPI spec on a legitimate HTTPS endpoint that declares internal server addresses (like http://127.0.0.1:9090 or AWS metadata endpoints), and the affected software will create tools that point to those internal targets. Versions prior to 1.1.2 are vulnerable.

• CVE-2026-46548MEDIUM 4.3

  NocoDB, a database-as-spreadsheet platform, contains a server-side request forgery (SSRF) vulnerability in its webhook notification system. An authenticated user with permissions to create webhooks can craft malicious requests to the Slack, Discord, Mattermost, or Teams webhook plugins that bypass intended network protections, allowing them to reach internal hosts that should be off-limits. The flaw stems from improper configuration of HTTP agent settings in four webhook integrations. This issue is resolved in version 2026.04.1 and later.

• CVE-2026-41854MEDIUM 4.2

  CVE-2026-41854 is a server-side request forgery (SSRF) vulnerability in Spring Framework caused by incorrect parsing of host names in URLs. When an application uses Spring's UriComponentsBuilder to process a URL provided by an external user, an attacker could craft a malicious URL that causes the application to make unintended requests to internal systems or services. The vulnerability affects Spring Framework versions 7.0.0 through 7.0.7 and 6.2.0 through 6.2.18. Exploitation requires user interaction and presents moderate risk.

• CVE-2026-48522MEDIUM 4.2

  PyJWT, a widely-used Python library for JSON Web Token handling, has a vulnerability in versions before 2.13.0 where it blindly accepts any URL scheme when fetching public key sets (JWKS). An attacker who can influence the URL used to fetch these keys—through JWT headers, configuration, or OAuth parameters—can trick the application into reading local files, attempting unusual protocol connections (FTP, data URIs), or in certain chained scenarios, forging valid tokens. The vulnerability requires specific conditions: the attacker must control the URL source, and token forgery scenarios require additional application-layer flaws like writable filesystem access.

• CVE-2026-10052MEDIUM 4.1

  Quay's configuration tool contains a weakness in how it validates LDAP and SMTP settings. When a configuration editor supplies endpoints for these services, the tool connects to them without restricting which IP addresses or hostnames are allowed. An attacker with config editor privileges can abuse this to make the Quay container reach internal network resources, allowing them to map and discover the organization's internal infrastructure from inside the cluster's network position.

• CVE-2026-53607LOW 3.7

  ApostropheCMS contains a server-side request forgery (SSRF) vulnerability in its file-serving feature. When the 'prettyUrls' option is enabled—a legitimate SEO feature for cleaner file URLs—the system incorrectly trusts the HTTP Host header sent by clients. An attacker can exploit this to make the ApostropheCMS server fetch content from arbitrary hosts on your internal network, potentially revealing information about your network topology and any verbose error messages from internal systems. The vulnerability is present in ApostropheCMS versions 4.30.0 and earlier. While the attacker cannot directly steal file contents across different instances, they can perform network reconnaissance and potentially trigger information disclosure from misconfigured internal services.

• CVE-2026-12566LOW 3.1

  CVE-2026-12566 is a vulnerability in bbot's docker_pull module where an attacker positioned between bbot and a Docker registry can intercept and modify the authentication redirect instructions sent by the registry. By tampering with the WWW-Authenticate response header, an attacker could trick bbot into sending authentication tokens to a malicious server under their control instead of the legitimate Docker registry, resulting in credential theft.