# Server-side request forgery

An attacker makes the server send requests on their behalf, often reaching internal systems that are not exposed to the internet.

How to fix: Upgrade, and send outbound requests through an allow-list that blocks internal addresses.


- [CVE-2026-83548](https://insights.sbomify.com/CVE-2026-83548/): SonicWall SMA1000 Appliances Server-Side Request Forgery (critical 10.0, exploited in the wild)
- [CVE-2026-15409](https://insights.sbomify.com/CVE-2026-15409/): SonicWall SMA1000 Appliances Server-Side Request Forgery (critical 10.0, exploited in the wild)
- [CVE-2022-27593](https://insights.sbomify.com/CVE-2022-27593/): QNAP Photo Station Externally Controlled Reference (critical 10.0, exploited in the wild)
- [CVE-2021-21975](https://insights.sbomify.com/CVE-2021-21975/): VMware Server Side Request Forgery in vRealize Operations Manager API (critical 9.8, exploited in the wild)
- [CVE-2021-27103](https://insights.sbomify.com/CVE-2021-27103/): Accellion FTA Server-Side Request Forgery (SSRF) (critical 9.8, exploited in the wild)
- [CVE-2020-7796](https://insights.sbomify.com/CVE-2020-7796/): Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (critical 9.8, exploited in the wild)
- [CVE-2023-48365](https://insights.sbomify.com/CVE-2023-48365/): Qlik Sense HTTP Tunneling (critical 9.6, exploited in the wild)
- [CVE-2023-41265](https://insights.sbomify.com/CVE-2023-41265/): Qlik Sense HTTP Tunneling (critical 9.6, exploited in the wild)
- [CVE-2025-62593](https://insights.sbomify.com/CVE-2025-62593/): Ray-Project Ray Code Injection (critical 9.4, exploited in the wild)
- [CVE-2026-64849](https://insights.sbomify.com/CVE-2026-64849/): MLflow Server-Side Request Forgery (critical 9.3, exploited in the wild)
- [CVE-2021-34473](https://insights.sbomify.com/CVE-2021-34473/): Microsoft Exchange Server Remote Code Execution (critical 9.1, exploited in the wild)
- [CVE-2021-26855](https://insights.sbomify.com/CVE-2021-26855/): Microsoft Exchange Server Remote Code Execution (critical 9.1, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/types/ssrf/