CWE-918 Server-Side Request Forgery (SSRF)

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host

Indico: Incomplete Server-Side Request Forgery (SSRF) check

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

Duplicate Advisory: PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

Duplicate Advisory: PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

Ghost: Server-Side Request Forgery in Bookmark Fetching

Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses

Next.js has Server-Side Request Forgery in Image Optimization

Backstage: Improper validation of MkDocs plugin configuration in TechDocs

Backstage: Improper input validation in Sentry scaffolder actions

PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass

Duplicate Advisory: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass

Backstage: Improper URL validation in catalog entity placeholder resolution

Backstage has improper input validation in TechDocs Markdown extension configuration

Ghost: Server-Side Request Forgery in Webhook Trigger

i18next-http-backend incomplete URL validation permits SSRF

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)

NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hosts

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass