CVE-2026-80347

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

CVE-2026-80347 mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

CVE-2026-80347 mcp-fetch through 1.6.3 Server-Side Request Forgery via Unstripped IPv6 Literal Brackets

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

CVE-2026-80347

mcp-fetch (npm package @kazuph/mcp-fetch ) through version 1.6.3 contains a Server-Side Request Forgery (SSRF) flaw in its isSafeUrl guard. When a target URL uses an IPv6 literal such as http://[::1]/, the parsed hostname retains the surrounding brackets. The net.isIP check returns zero for the b...

PT-2026-82065

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

CVE-2026-80347: Server-Side Request Forgery (SSRF)

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

The webcrawl tool performs its SSRF check only on the initial URL: it resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results. It then passes the URL to a fetcher that uses httpx.Clientfollowredirects=True - or urllib.request.urlopen when httpx is...

Malicious code in kelly-stake-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...

CVE-2026-10582

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

EUVD-2026-64775

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

CVE-2026-10582 Hugo 0.91.0 through 0.165.0 Server-Side Request Forgery via security.http.urls Lacking Destination Address Validation

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or...

Malicious code in 6-viewsight-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96501ebb5a5bb3858767545e256cdcfd23f164f4435c109d206f421771ce6e68 The package's main module is a self-executing IIFE that fetches HTML from https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight and...

CVE-2026-77781: Uncaught Exception

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the...

CVE-2026-77781

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the...

CVE-2026-62960

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...

CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

CVE-2026-54508 TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution

TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList and importNaverList in server/src/services/placeService.ts and resolveGoogleMapsUrl in server/src/services/mapsService.ts. The affected sinks call...

Server-side Request Forgery (SSRF)

Overview @platejs/docx-io is a DOCX import/export for Plate - file-based document conversion Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the buildImage and buildParagraph functions in render-document-file.ts and xml-builder.ts, which unconditionally...

CVE-2026-53585

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, gitdeltaapply in src/libgit2/delta.c trusts the attacker-controlled ressz value parsed by hdrsz from...

CVE-2026-53585 libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, gitdeltaapply in src/libgit2/delta.c trusts the attacker-controlled ressz value parsed by hdrsz from...