Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling

auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs

DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool

customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection

Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

9router: Image prefetch DNS rebinding allows SSRF to internal services

LMDeploy has an SSRF bypass

unstructured: Server-Side Request Forgery in the URL-based partitioning

Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role

budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation

PraisonAI: SpiderTools redirect-target SSRF protection bypass

Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal

Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection

local-deep-research is Vulnerable to HTML Injection via Unescaped

PraisonAI has an SSRF bypass

LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via

server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting

NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but requests.get follows redirects and re-resolves