CVE-2026-108786

A vulnerability exists in houtini-ai seo-crawler-mcp up to version 2.1.5 within the Crawler component. The flaw resides specifically in the run_seo_audit function located in the src/core/CrawlOrchestrator.ts file. This vulnerability allows for server-side request forgery (SSRF) and can be launche...

CVE-2026-108786 houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request forgery

A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function runseoaudit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been...

CVE-2026-109423: Improper Certificate Validation

NetEase Cloud Music client for Windows cloudmusic.exe versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or...

PT-2026-110919

Name of the Vulnerable Software and Affected Versions Flower versions prior to 2.2.0 Description Cross-site request forgery occurs because Tornado xsrf cookies are disabled and the OAuth session cookie lacks the SameSite attribute. This allows attackers to trick authenticated users into visiting...

PT-2026-110654

Name of the Vulnerable Software and Affected Versions Crawl4AI versions 0.9.0 through 0.9.3 Description An untrusted-config gate bypass allows non-admin API clients to create forbidden configuration objects by using dict-type wrappers. An attacker can send a manipulated LLMConfig object where the...

PT-2026-110440

Name of the Vulnerable Software and Affected Versions yangzongzhuan RuoYi version 4.8.3 Description A remote cross-site request forgery CSRF issue exists in an unknown function. CSRF is a type of attack that tricks a victim into submitting a malicious request. It can be executed remotely...

Debian dsa-6556 : nagios4 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6556 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6556-1 [email protected] https://www.debian.org/securit...

PT-2026-110553

Name of the Vulnerable Software and Affected Versions Ollama versions prior to 0.34.2 Description An issue exists in the Pull API where the IsValid function within the types/model/name.go file fails to properly validate model names. This allows a remote attacker to provide crafted input that...

TencentOS Server 4: python-jwt (TSSA-2026:1087)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1087 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2026-109237: Deserialization of Untrusted Data

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with apitoken set to an env reference via /config/dump to read SECRETK...

CVE-2026-108770

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...

CVE-2026-108770 Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...

CVE-2026-108741

Shepherd shepherd-ai through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the publicurl guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and...

CVE-2026-108738

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

UBUNTU-CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxyurl. Attackers can point proxyurl at loopback or internal hosts, bypassing FETCHERALLOWPRIVATENETWORKS checks to probe internal...

EUVD-2026-96904

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

CVE-2026-108738 Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback

Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenID Connect callback never validates the OAuth state parameter. Attackers can induce a victim's browser to load...

CVE-2026-108572 Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from...

CVE-2026-108572

A server-side request forgery (SSRF) vulnerability exists in Casdoor up to versions 3.164.0 and 4.10.0 . The flaw is located in the CasP3ProxyValidate function within the controllers/cas.go file of the Proxy Validation component. An attacker can remotely manipulate the pgtUrl argument to trigger ...

CVE-2026-108572

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from...