CWE-918 · Server-Side Request Forgery
Server-Side Request Forgery
3,959CVEs
24exploited
143with a public check
47likely (EPSS 10%+)
SortMost likely exploited
3,959 CVEs with CWE-918 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-21893In CISA KEVExploitedIvanti SAML - Server Side Request Forgery (SSRF)Ivanti · ICS · CVSS 8.2 · 2024-01-31 | 8.2 | 100% | 2024-01-31 |
| CVE-2021-40438In CISA KEVExploitedApache <= 2.4.48 Mod_Proxy - Server-Side Request ForgeryApache Software Foundation · Apache HTTP Server · CVSS 9 · 2021-09-16 | 9.0 | 100% | 2021-09-16 |
| CVE-2021-34473In CISA KEVExploitedExchange Server - Remote Code ExecutionMicrosoft · Microsoft Exchange Server 2013 Cumulative Update 23 · CVSS 9.1 · 2021-07-14 | 9.1 | 100% | 2021-07-14 |
| CVE-2021-26855In CISA KEVExploitedMicrosoft Exchange Server SSRF VulnerabilityMicrosoft · Microsoft Exchange Server 2013 Cumulative Update 21 · CVSS 9.1 · 2021-03-02 | 9.1 | 100% | 2021-03-02 |
| CVE-2022-41040In CISA KEVExploitedMicrosoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft · Microsoft Exchange Server 2013 Cumulative Update 23 · CVSS 8.8 · 2022-10-03 | 8.8 | 100% | 2022-10-03 |
| CVE-2021-22986In CISA KEVExploitedF5 iControl REST - Remote Command ExecutionF5 · BIG-IP; BIG-IQ · CVSS 9.8 · 2021-03-31 | 9.8 | 100% | 2021-03-31 |
| CVE-2021-22054In CISA KEVExploitedVMWare Workspace ONE UEM - Server-Side Request ForgeryOmnissa · VMware Workspace ONE UEM console · CVSS 7.5 · 2021-12-17 | 7.5 | 100% | 2021-12-17 |
| CVE-2021-21311In CISA KEVExploitedAdminer <4.7.9 - Server-Side Request Forgeryvrana · adminer · CVSS 7.2 · 2021-02-11 | 7.2 | 98% | 2021-02-11 |
| CVE-2025-61884In CISA KEVExploitedOracle E-Business Suite - Server-Side Request ForgeryOracle Corporation · Oracle Configurator · CVSS 7.5 · 2025-10-12 | 7.5 | 96% | 2025-10-12 |
| CVE-2020-7796In CISA KEVExploitedZimbra Collaboration Suite < 8.8.15 Patch 7 - Server-Side Request ForgerySynacor · Zimbra Collaboration Suite · CVSS 9.8 · 2020-02-18 | 9.8 | 94% | 2020-02-18 |
| CVE-2023-41763In CISA KEVExploitedSkype for Business 2019 (SfB) - Blind Server-side Request ForgeryMicrosoft · Skype for Business Server 2015 CU13 · CVSS 5.3 · 2023-10-10 | 5.3 | 90% | 2023-10-10 |
| CVE-2026-20230In CISA KEVExploitedCisco Unified Communications Manager Server-Side Request Forgery VulnerabilityCisco · Cisco Unified Communications Manager · CVSS 8.6 · 2026-06-03 | 8.6 | 89% | 2026-06-03 |
| CVE-2021-21973In CISA KEVExploitedVMware vSphere - Server-Side Request ForgeryVMware · VMware vCenter Server · CVSS 5.3 · 2021-02-24 | 5.3 | 88% | 2021-02-24 |
| CVE-2019-9621In CISA KEVExploitedZimbra Collaboration Suite - SSRFSynacor · Zimbra Collaboration Suite (ZCS) · CVSS 7.5 · 2019-04-30 | 7.5 | 81% | 2019-04-30 |
| CVE-2021-21975In CISA KEVExploitedvRealize Operations Manager API - Server-Side Request ForgeryVMware · VMware vRealize Operations · CVSS 9.8 · 2021-03-31 | 9.8 | 78% | 2021-03-31 |
| CVE-2016-3718In CISA KEVExploitedThe (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted im…ImageMagick · ImageMagick · CVSS 5.5 · 2016-05-05 | 5.5 | 76% | 2016-05-05 |
| CVE-2021-22175In CISA KEVExploitedGitLab CI Lint API - Server-Side Request ForgeryGitLab · GitLab · CVSS 6.8 · 2021-06-11 | 6.8 | 53% | 2021-06-11 |
| CVE-2021-39935In CISA KEVExploitedAn issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.…GitLab · GitLab · CVSS 6.8 · 2021-12-13 | 6.8 | 36% | 2021-12-13 |
| CVE-2026-96652In CISA KEVExploitedPlex Media Server < 1.43.3.10861 - Unauthenticated SSRF via Companion Protocol (plex2shell)Plex · Media Server · CVSS 4.3 · 2026-09-23 | 4.3 | 12% | 2026-09-23 |
| CVE-2026-96655In CISA KEVExploitedPlex Media Server < 1.43.3.10861 - SSRF via TranscoderPlex · Media Server · CVSS 4.3 · 2026-09-23 | 4.3 | 11% | 2026-09-23 |
| CVE-2026-64849In CISA KEVExploitedMLflow Webhook SSRF - Unauthenticated Full-Read via Redirect Bypassmlflow · mlflow · CVSS 9.3 · 2026-08-17 | 9.3 | 10% | 2026-08-17 |
| CVE-2021-27103In CISA KEVExploitedAccellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.Accellion · FTA · CVSS 9.8 · 2021-02-16 | 9.8 | 8.2% | 2021-02-16 |
| CVE-2026-83548In CISA KEVExploitedSonicWall SMA1000 WorkPlace - Unauthenticated SSRF to CouchDBSonicWall · SMA1000 · CVSS 10 · 2026-09-01 | 10.0 | 8.0% | 2026-09-01 |
| CVE-2026-15409In CISA KEVExploitedSonicWall SMA1000 - Server-Side Request ForgerySonicWall · SMA1000 · CVSS 10 · 2026-07-14 | 10.0 | 6.8% | 2026-07-14 |
| CVE-2020-13379CheckGrafana 3.0.1-7.0.1 - Server-Side Request ForgeryGrafana · Grafana · 2020-06-03 | – | 100% | 2020-06-03 |
| CVE-2024-45507CheckApache OFBiz - Remote Code ExecutionApache Software Foundation · Apache OFBiz · CVSS 8.8 · 2024-09-04 | 8.8 | 96% | 2024-09-04 |
| CVE-2023-51467CheckApache OFBiz < 18.12.11 - Remote Code ExecutionApache Software Foundation · Apache OFBiz · 2023-12-26 | – | 96% | 2023-12-26 |
| CVE-2019-8451CheckJira <8.4.0 - Server-Side Request ForgeryAtlassian · Jira · 2019-09-11 | – | 94% | 2019-09-11 |
| CVE-2021-27905CheckApache Solr <=8.8.1 - Server-Side Request ForgeryApache Software Foundation · Apache Solr · 2021-04-13 | – | 93% | 2021-04-13 |
| CVE-2020-26948CheckEmby < 4.5.0 - Server Server-Side Request ForgeryEmby · Emby · 2020-10-10 | – | 87% | 2020-10-10 |
| CVE-2023-48022CheckAnyscale Ray - Remote Code ExecutionAnyscale · Ray · CVSS 9.8 · 2023-11-28 | 9.8 | 84% | 2023-11-28 |
| CVE-2023-49785CheckChatGPT-Next-Web - SSRF/XSSChatGPTNextWeb · NextChat · CVSS 9.1 · 2024-03-11 | 9.1 | 83% | 2024-03-11 |
| CVE-2020-26258CheckXStream <1.4.15 - Server-Side Request Forgeryx-stream · xstream · CVSS 6.3 · 2020-12-16 | 6.3 | 82% | 2020-12-16 |
| CVE-2018-14728CheckResponsive filemanager 9.13.1 Server-Side Request ForgeryTecrail · Responsive Filemanager · 2018-08-03 | – | 76% | 2018-08-03 |
| CVE-2017-9506CheckAtlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request ForgeryAtlassian · Atlassian OAuth Plugin · 2017-08-23 | – | 76% | 2017-08-23 |
| CVE-2020-24881CheckOsTicket < 1.14.3 - Server Side Request ForgeryEnhancesoft · Osticket · 2020-11-02 | – | 73% | 2020-11-02 |
| CVE-2022-1386CheckWordPress Fusion Builder <3.6.2 - Server-Side Request ForgeryFusion Builder Project · Fusion Builder · 2022-05-16 | – | 71% | 2022-05-16 |
| CVE-2021-29490CheckJellyfin 10.7.2 - Server Side Request Forgeryjellyfin · jellyfin · CVSS 5.8 · 2021-05-05 | 5.8 | 70% | 2021-05-05 |
| CVE-2025-27817CheckApache Kafka Client - Arbitrary File ReadApache Software Foundation · Apache Kafka Client · CVSS 7.5 · 2025-06-10 | 7.5 | 70% | 2025-06-10 |
| CVE-2020-10770CheckKeycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)Redhat · keycloak · 2020-12-15 | – | 70% | 2020-12-15 |
| CVE-2024-38472CheckApache HTTPd Windows UNC - Server-Side Request ForgeryApache Software Foundation · Apache HTTP Server · CVSS 7.5 · 2024-07-01 | 7.5 | 69% | 2024-07-01 |
| CVE-2021-33690CheckSAP NetWeaver Development Infrastructure - Server Side Request ForgerySAP SE · SAP NetWeaver Development Infrastructure (Component Build Service) · CVSS 9.9 · 2021-09-15 | 9.9 | 69% | 2021-09-15 |
| CVE-2023-43795CheckGeoServer WPS - Server Side Request Forgerygeoserver · geoserver · CVSS 8.6 · 2023-10-24 | 8.6 | 69% | 2023-10-24 |
| CVE-2021-32682CheckelFinder 2.1.58 - Remote Code ExecutionStudio-42 · elFinder · CVSS 9.8 · 2021-06-14 | 9.8 | 68% | 2021-06-14 |
| CVE-2020-6308CheckSAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request ForgerySAP SE · SAP BusinessObjects Business Intelligence Platform (Web Services) · CVSS 5.3 · 2020-10-20 | 5.3 | 62% | 2020-10-20 |
| CVE-2021-27670CheckAppspace 6.2.4 - Server-Side Request ForgeryAppspace · Appspace · 2021-02-25 | – | 61% | 2021-02-25 |
| CVE-2021-24472CheckOnair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request ForgeryQantumThemes · QT KenthaRadio · 2021-08-02 | – | 57% | 2021-08-02 |
| CVE-2024-32964CheckLobe Chat <= v0.150.5 - Server-Side Request Forgerylobehub · lobe-chat · CVSS 9 · 2024-05-10 | 9.0 | 53% | 2024-05-10 |
| CVE-2026-33626CheckLMDeploy - Server-Side Request ForgeryInternLM · lmdeploy · CVSS 7.5 · 2026-04-20 | 7.5 | 45% | 2026-04-20 |
| CVE-2018-15517CheckD-Link Central WifiManager - Server-Side Request ForgeryDlink · Central Wifimanager · 2019-01-31 | – | 44% | 2019-01-31 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.