CVE-2026-19337

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-19337 adenot mcp-google-search read_webpage index.ts server-side request forgery

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-19337

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-19337

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-19337

CVE-2026-19337 affects the package adenot mcp-google-search up to version 0.3.1. The vulnerability is in an unknown function within src/index.ts of the component read_webpage , enabling server-side request forgery (SSRF) through manipulation of the url argument. The attack is described as restric...

EUVD-2026-54887

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-19337 adenot mcp-google-search read_webpage index.ts server-side request forgery

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

PT-2026-69311

Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP version 1.0.24 Description A server-side request forgery exists in the read range config component within the src/tools/rangeConfig.ts file. A remote attacker can trigger this issue by manipulating the Source argument,...

PT-2026-69281

Name of the Vulnerable Software and Affected Versions anubissbe ProjectHub-Mcp versions prior to 5.0.1 Description A weakness in the Webhooks API component, specifically within the file backend-fix/complete backend.js, allows for server-side request forgery SSRF. This occurs when the url argument...

Cryptographic Failure org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center

This High severity Cryptographic Failure vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Cryptographic Failure vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

CVE-2026-67620

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-67620 Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-67620

CVE-2026-67620 affects Flowise up to version 3.1.4, where the SSRF guard in httpSecurity.ts uses a faulty DEFAULT_DENY_LIST. The list blocks the AWS/GCP/Azure/DO metadata IPs 169.254.169.254 but omits OCI 192.0.0.192 and Alibaba Cloud 100.100.100.200 (and the 100.64.0.0/10 CGNAT range). An authen...

EUVD-2026-54793

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

CVE-2026-67620

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:21543-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21543-1 advisory. Changes in python-Django: - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997 - CVE-2026-15337: potentia...

CVE-2026-46409 OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...

CVE-2026-46409 OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...

CVE-2026-18353

A flaw was found in PIA. An unauthenticated attacker can exploit a Server-Side Request Forgery SSRF vulnerability by crafting a malicious OpenID Connect OIDC issuer URL. This bypasses an internal allowlist due to inconsistent URL parsing between Python's urlparse and the requests/urllib3 librarie...

CVE-2026-19246 HKUDS nanobot Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery

A vulnerability has been found in HKUDS nanobot up to 0.2.1. This affects the function downloadimagedataurl of the file nanobot/providers/imagegeneration.py of the component Provider-returned Image URL Handler. The manipulation leads to server-side request forgery. It is possible to initiate the...