recorded together · two weakness classes
Race Conditions and Server-Side Request Forgery
36 CVEs
36 CVEs name a weakness of both Race Conditions and Server-Side Request Forgery, fewer than chance alone would give (about 42). The pairing most often behind it is CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition) with CWE-918 (Server-Side Request Forgery), in 35 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 36
- Chance alone would give
- about 42
- So they are recorded together
- less often than chance (0.9×)
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial only for pairs with enough CVEs and clearly above chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
- check available
- 1
Every one of the 36 is a mark on the map. Named now: 1 to 26, most at risk first.
- WordPress <= 6.2 - Server Side Request Forgery
- Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader
- ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
- EspoCRM: SSRF via DNS Rebinding in Attachment fromImageUrl Endpoint Allows Internal Network Access
- PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
- Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)
- draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist
- datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding
- MCP Atlassian: Incomplete fix for CVE-2026-27826: DNS rebinding bypasses SSRF validation (validated IP not pinned)
- Budibase: SSRF via DNS rebinding in the REST datasource integration
- Indico has Server-Side Request Forgery (SSRF) in multiple places
- Gitea push mirror SSRF and forced writes to internal Git hosts
- PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
- PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
- Open WebUI: DNS Rebinding SSRF Bypass
- PraisonAI: SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)
- Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pinning after DNS-based validation
- n8n-MCP: Authenticated SSRF in n8n-mcp webhook and API client paths
- Ghost: Server-Side Request Forgery in Bookmark Fetching
- Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
- Statamic: Server-Side Request Forgery via Glide (DNS rebinding)
- Ghost: Server-side request forgery via DNS rebinding in external request handling
- Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validation
- Weblate: DNS rebinding in VCS operations allows server-side request forgery
- MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch
- 2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.