SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read

Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py

Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

Budibase: SSRF via DNS rebinding in the REST datasource integration

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

praisonaiagents: SSRF guard validates literal IPs only and never resolves

Open WebUI: Redirect-Bypass SSRF in OAuth `_process_picture_url` (incomplete-fix sibling

auth-fetch-mcp: SSRF and disk exfiltration via unvalidated auth_fetch and download_media URLs

DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool

customized large language model flow. Prior to 3.1.0, a Server-Side Request Forgery (SSRF) protection bypass vulnerability exists in the Custom Function feature. While the application implements SSRF protection

Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains

9router: Image prefetch DNS rebinding allows SSRF to internal services

LMDeploy has an SSRF bypass

Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass vulnerability in the API Request component. An authenticated attacker with low-level privileges (flow author role

budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation