Server-Side Request Forgery

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

1. Craft CMS vulnerable to Server-Side Request Forgery (SSRF) via GraphQL Asset Upload MutationCVE-2025-68437craftcms · CVSS 5 · 0.5% likely

   CWE-918

2. Cloud Metadata SSRF Protection Bypass via IPv6 ResolutionCVE-2026-27129craftcms · CVSS 5.7 · 0.5% likely

   CWE-918

3. Craft has a save_images_Asset graphql mutation can be abused to exfiltrate AWS credentials of underlying hostCVE-2026-25492craftcms · CVSS 5.3 · 0.5% likely

   CWE-918

4. Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJsCVE-2026-55791craftcms · CVSS 6.9 · 0.5% likely

   CWE-918

5. Craft has a SSRF in GraphQL Asset Mutation via Alternative IP NotationCVE-2026-25494craftcms · CVSS 6.9 · 0.4% likely

   CWE-918

6. Craft has a SSRF in GraphQL Asset Mutation via HTTP RedirectCVE-2026-25493craftcms · CVSS 6.9 · 0.4% likely

   CWE-918

7. Craft CMS has a host header injection leading to SSRF via resource-js endpointCVE-2026-41130craftcms · CVSS 5.5 · 0.3% likely

   CWE-918

8. Craft CMS has Server-Side Request Forgery (SSRF) with Asset Uploads MutationsCVE-2026-41129craftcms · CVSS 5.5 · 0.3% likely

   CWE-918

9. Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutationCVE-2026-72784craftcms · CVSS 5.4 · 0.2% likely

   CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.