Open WebUI: Path traversal / SSRF in terminal server proxy via encoded path traversal

Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection

PraisonAI has an SSRF bypass

MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via

server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting

NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The check_ssrf_url guard validates URLs once but requests.get follows redirects and re-resolves

protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing

Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSReaderComponent in rss.py and SearXNG component in searxng.py make unvalidated HTTP requests to user-controlled URLs

Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate

Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSRF guard. Attackers can bypass SSRF protection by providing malicious photo URLs to the Zalo

powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the underlying

Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web

source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet

CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning

IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

PraisonAI Vulnerable to Server-Side Request Forgery via Unvalidated webhook

OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete

controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space, configures an AI provider with