124106 matches found
GHSA-G2GW-Q38M-VJFC Lokka: Azure Resource Manager URL path validation issue
Lokka versions prior to 2.1.2 constructed Azure Resource Manager request URLs using direct string concatenation with user-controlled path input. Specially crafted path values could alter URL authority parsing and cause Azure Resource Manager bearer tokens to be sent to an unintended host. Version...
CVE-2026-49295
creationtimestamp| type| source ---|---|--- 2026-06-19 21:58:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moodmsmybf2i...
CVE-2026-49346
creationtimestamp| type| source ---|---|--- 2026-06-19 21:55:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moodgnj5j42g...
CVE-2026-48773
creationtimestamp| type| source ---|---|--- 2026-06-19 21:49:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mood3toclx2h 2026-06-20 06:00:24+00:00| seen| https://infosec.exchange/users/offseq/statuses/116780906773492544 2026-06-20 06:00:25+00:00| seen|...
Server-side Request Forgery (SSRF)
Overview mcp-searxng is a MCP server for SearXNG integration Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the weburlread process due to insufficient validation in the assertUrlAllowed function. An attacker can access internal network resources and...
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
DNS-resolved Private Hostname SSRF in weburlread Summary The weburlread MCP tool in mcp-searxng is vulnerable to Server-Side Request Forgery SSRF via DNS rebinding bypass. The assertUrlAllowed function at src/url-reader.ts:85-93 validates only the syntactic hostname string against a private...
GHSA-MRVX-JMJW-VGGC SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
DNS-resolved Private Hostname SSRF in weburlread Summary The weburlread MCP tool in mcp-searxng is vulnerable to Server-Side Request Forgery SSRF via DNS rebinding bypass. The assertUrlAllowed function at src/url-reader.ts:85-93 validates only the syntactic hostname string against a private...
NPM: SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
NPM: SearXNG MCP Server: DNS-resolved Private Hostname SSRF in weburlread vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.7.1...
Allocation of Resources Without Limits or Throttling
Overview mcp-searxng is a MCP server for SearXNG integration Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the weburlread process. An attacker can cause excessive memory and CPU consumption by supplying a specially crafted URL tha...
SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
Unbounded Response Body Read Bypasses URL Size Limit in weburlread Summary The weburlread MCP tool in mcp-searxng enforces its 5 MiB response-size limit exclusively by inspecting the Content-Length header of a preliminary HEAD request. When a server omits Content-Length — a standard HTTP practice...
GHSA-XCQX-9JF5-W339 SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
Unbounded Response Body Read Bypasses URL Size Limit in weburlread Summary The weburlread MCP tool in mcp-searxng enforces its 5 MiB response-size limit exclusively by inspecting the Content-Length header of a preliminary HEAD request. When a server omits Content-Length — a standard HTTP practice...
CVE-2008-6546
creationtimestamp| type| source ---|---|--- 2026-06-19 21:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moocg2ra3d2p...
GHSA-M999-J542-5W3R Open Redirect Bypass in miniflux-v2
Summary The URL restrictions in miniflux-v2 can be bypassed by attackers, leading to an open redirect vulnerability. Details Normally, the redirect URL needs to be validated using IsRelativePath. There are some security measures in place, such as requiring relative paths, prohibiting host and...
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
Impact CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffic. NetNamedPipe creates a shared memory object based on the listening url, then generated a unique GUID for the named pipe it will be using and saves this ...
CVE-2008-6557
creationtimestamp| type| source ---|---|--- 2026-06-19 20:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3moo72rsqmo2a...
EUVD-2026-38091
Url redirection to untrusted site 'open redirect' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-48794
CVE-2026-48794 affects Authelia (versions 4.36.0–4.39.19). A domain canonicalization edge case can cause an access control rule to be skipped when it should match a request, under very specific conditions involving forwarded authorization, multi-segment subdomains (e.g., a.b.example.com vs exampl...
CVE-2019-25755
creationtimestamp| type| source ---|---|--- 2026-06-19 19:59:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moo4xgslle2g...