Server-Side Request Forgery

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. Gotenberg <= 8.30.1 - Server Side Request ForgeryCVE-2026-40280gotenberg · CVSS 7.8 · 1.9% likely

   CWE-918

2. Gotenberg < 8.31.0 - Server-Side Request ForgeryCVE-2026-42596gotenberg · CVSS 9.4 · 1.6% likely

   CWE-918

3. Gotenberg < 8.34.0 - Local File DisclosureCVE-2026-55229gotenberg · CVSS 7.5 · 1.5% likely

   CWE-918

4. Gotenberg 8.31.0 before 8.38.0 SSRF via IPv6 Zone Identifiers in IsPublicIPCVE-2026-126799gotenberg · CVSS 7.5 · 0.4% likely

   CWE-918

5. Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List BypassCVE-2026-42595gotenberg · CVSS 8.6 · 0.3% likely

   CWE-918

6. Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v8CVE-2026-42591gotenberg · CVSS 8.2 · 0.3% likely

   CWE-918

7. Gotenberg unauthenticated blind SSRF via unfiltered webhook URLCVE-2026-39383gotenberg · CVSS 6.9 · 0.2% likely

   CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.