CVE-2026-108850

The Company Research Agent software (versions through 2.2.0 ) is vulnerable to a server-side request forgery (SSRF) via the /generate-pdf endpoint. The root cause is the injection of unescaped ReportLab paragraph markup into the report_content parameter. Unauthenticated attackers can embed inline...

EUVD-2026-97001

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...