tag
Cwe-918
Critical (per Ciscos own Security Impact Rating, despite a High numeric CVSS)
Cisco Unified Communications Manager WebDialer SSRF → Arbitrary File Write → Root (CVE-2026-20230)
CVE-2026-20230 (cisco-sa-cucm-ssrf-cXPnHcW)·
Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) — WebDialer service
patched
Critical
SonicWall SMA1000 WorkPlace SSRF → Internal Erlang RPC Remote Code Execution (CVE-2026-15409)
CVE-2026-15409 (SNWLID-2026-0008)·
SonicWall SMA1000 Appliance — WorkPlace interface (websocket proxy service)
unpatched
Critical
ThingsBoard IoT Platform SSRF via SVG Image Upload (CVE-2025-34282)
CVE-2025-34282·
ThingsBoard IoT Platform (Image Upload Gallery / Widget Library)
patched
Medium
WordPress User Language Switch Plugin SSRF — CVE-2026-0745
CVE-2026-0745 (GHSA-m38c-5p3m-p7gm)·
WordPress "User Language Switch" plugin
unpatched
High
Unauthenticated SSRF in Ech0 via /api/website/title (CVE-2026-35037)
CVE-2026-35037·
lin-snow/Ech0
unpatched
Critical
Plunk SSRF via Unvalidated AWS SNS SubscriptionConfirmation — CVE-2026-32096
CVE-2026-32096·
Plunk (useplunk/plunk) email/webhook API
unpatched
High
pdfmake Server-Side Request Forgery via Unvalidated Document URLs (CVE-2026-26801)
CVE-2026-26801·
pdfmake (Node.js PDF generation library), src/URLResolver.js
patched
High
Kan SSRF via Attachment Download Endpoint — CVE-2026-32255
CVE-2026-32255 (GHSA-qrx8-9hc6-jvqg)·
Kan (kanbn/kan) open-source project management tool
patched
Medium
EspoCRM 9.3.3 Authenticated SSRF via Alternative IPv4 Loopback Notation — CVE-2026-33534
CVE-2026-33534·
EspoCRM 9.3.3
patched
High
Chamilo LMS Unauthenticated install.ajax.php SSRF + Open Mail Relay — CVE-2026-33715
CVE-2026-33715 / GHSA-mxc9-9335-45mc·
Chamilo LMS 2.0
unpatched
High
@haxtheweb/open-apis Credential Exposure via SSRF in cacheAddress Endpoint (CVE-2026-46391)
CVE-2026-46391 (GHSA-4fg7-f244-3j49)·
@haxtheweb/open-apis (HAXcms/HAX ecosystem web service APIs)
unpatched