recorded together · two weakness classes
Information Disclosure and Server-Side Request Forgery
49 CVEs
49 CVEs name a weakness of both Information Disclosure and Server-Side Request Forgery, about what chance alone would give (51). The pairing most often behind it is CWE-200 (Information Exposure) with CWE-918 (Server-Side Request Forgery), in 32 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 49
- Chance alone would give
- about 51
- So they are recorded together
- about as often as chance
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial only for pairs with enough CVEs and clearly above chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
- check available
- 1
- likely to be exploited
- 1
Every one of the 49 is a mark on the map. Named now: 1 to 26, most at risk first.
- Apache OFBiz < 18.12.11 - Server Side Request Forgery
- Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability…
- Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" feature
- http4k has a potential XXE (XML External Entity Injection) vulnerability
- GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery
- Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of…
- Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy, allowing injectio…
- Apache Allura: sensitive information exposure via DNS rebinding
- XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery
- Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control he…
- Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability
- AVTECH DVR Devices Server-Side Request Forgery
- SolidCAM-GPPL-IDE: Path traversal in `inc` directive enables file probing and NTLM-hash leak
- Kyverno: ServiceAccount token leaked to external servers via apiCall service URL
- Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate
- datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`
- Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON
- linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect
- oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs
- InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure
- Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
- Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows
- OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects
- Dimension Blind SSRF via Database Test Connection Feature
- Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks
- Activepieces: Server-side request forgery in MCP tool validation endpoint
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.