lightnovel-crawler (>=2.11.0, <=2.11.1) potentially affected by CVE-2026-55073 via weasyprint (48.0.0)

weasyprint PYPI version 48.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - lightnovel-crawler =2.11.0, =2.11.1 Source cves: CVE-2026-55073 Source advisory: OSV:PYSEC-2026-3940...

lightnovel-crawler (>=2.7.15, <=2.10.1) potentially affected by CVE-2026-55073 via weasyprint (45.0.0)

weasyprint PYPI version 45.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - lightnovel-crawler =2.7.15, =2.10.1 Source cves: CVE-2026-55073 Source advisory: OSV:PYSEC-2026-3940...

scrapy-amazon-robot-middleware3 (>=0.2.3, <=0.3.3), searchstax-simulator-crawler (>=0.0.1a22, <=0.0.1a23) potentially affected by CVE-2026-84366 via scrapy (1.3.3)

scrapy PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - scrapy-amazon-robot-middleware3 =0.2.3, =0.0.1a22, =0.0.1a23 Source cves: CVE-2026-84366 Source advisory: OSV:PYSEC-2026-3918...

gulp-dissect (>=1.0.1, <=1.0.3), lazy-crawler (>=2.0.0, <=2.0.1) +1 more potentially affected by CVE-2026-55558 via aiosmtplib (>=5.0.0, <=5.1.0)

aiosmtplib PYPI version =5.0.0, =1.0.1, =2.0.0, =1.7.14, =1.7.605 Source cves: CVE-2026-55558 Source advisory: OSV:PYSEC-2026-3805...

lightnovel-crawler (>=2.11.0, <=2.11.1) potentially affected by CVE-2026-55073 via weasyprint (48.0.0)

weasyprint PYPI version 48.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - lightnovel-crawler =2.11.0, =2.11.1 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...

lightnovel-crawler (>=2.7.15, <=2.10.1) potentially affected by CVE-2026-55073 via weasyprint (45.0.0)

weasyprint PYPI version 45.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - lightnovel-crawler =2.7.15, =2.10.1 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...

CVE-2026-86173

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

CVE-2026-86173

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

CVE-2026-86173

MindsDB (mindshub) through 26.1.0 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the web crawler handler . By supplying caller-controlled URLs to CrawlerTable.list , attackers can bypass the allowlist control due to a default empty configuration , allowing them to...

CVE-2026-86173 MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

CVE-2026-86173 MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

EUVD-2026-71972

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

CVE-2026-86173 MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

CVE-2026-86173: Server-Side Request Forgery (SSRF)

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

PT-2026-86397

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

scrapy-amazon-robot-middleware3 (>=0.2.3, <=0.3.3), searchstax-simulator-crawler (>=0.0.1a22, <=0.0.1a23) potentially affected by CVE-2026-84366 via scrapy (1.3.3)

scrapy PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - scrapy-amazon-robot-middleware3 =0.2.3, =0.0.1a22, =0.0.1a23 Source cves: CVE-2026-84366 Source advisory: OSV:GHSA-76G3-C3X4-CRVX...

PT-2026-84860

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.10.3-lts and earlier Description An authenticated workspace user can perform a Server-Side Request Forgery SSRF via the knowledge web-document import and synchronization crawler. The application passes a user-supplied URL to t...

Exploit for CVE-2026-82286

CVE-2026-82286 — gpt-crawler Unauthenticated Arbitrary File Wr...

CVE-2026-82286

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...

CVE-2026-82286

gpt-crawler through version 1.5.1 (BuilderIO) is vulnerable to an arbitrary file write via the outputFileName parameter in the POST /crawl endpoint. The root cause is a failure to validate this parameter, allowing unauthenticated attackers to supply absolute paths or parent-directory segments and...