Server-side request forgery vulnerabilities
An attacker makes the server send requests on their behalf, often reaching internal systems that are not exposed to the internet.
Server-side request forgery in numbers
sbomify tracks 4,428 server-side request forgery vulnerabilities. Most are found in web application (45%), server software (23%) and library (15%).
How to fix server-side request forgery vulnerabilities
Upgrade, and send outbound requests through an allow-list that blocks internal addresses.
Most exploited server-side request forgery vulnerabilities
- CVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery
- CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery
- CVE-2022-27593 QNAP Photo Station Externally Controlled Reference
- CVE-2021-21975 VMware Server Side Request Forgery in vRealize Operations Manager API
- CVE-2021-27103 Accellion FTA Server-Side Request Forgery (SSRF)
- CVE-2020-7796 Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery
- CVE-2023-48365 Qlik Sense HTTP Tunneling
- CVE-2023-41265 Qlik Sense HTTP Tunneling
- CVE-2025-62593 Ray-Project Ray Code Injection
- CVE-2026-64849 MLflow Server-Side Request Forgery
- CVE-2021-34473 Microsoft Exchange Server Remote Code Execution
- CVE-2021-26855 Microsoft Exchange Server Remote Code Execution
Recently published
- CVE-2026-108764 Apache Kylin: job-driver UI proxy SSRF
- CVE-2026-111899 KitchenOwl through 0.7.10 SSRF via Recipe Import scrapeKitchenOwl Fetch
- CVE-2026-111936 Sigma File Manager through 2.2.0 SSRF via Extension Download Commands
- CVE-2026-112076 Server-side request forgery in MeTube
- CVE-2026-112254 agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery
- CVE-2026-112267 SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.