CVE-2026-112297

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

CVE-2026-112297 ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

EUVD-2026-104594

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

CVE-2026-112297

A server-side request forgery (SSRF) vulnerability exists in ptbsare anx-calibre-manager versions up to 1.13.12 . The flaw is located within the LLM Configuration Handler component, specifically in the LLMClient.chat function of the file blueprints/api/llm.py. An attacker can remotely initiate th...

CVE-2026-112297: Server-Side Request Forgery (SSRF)

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

Cognee allows non-superusers to overwrite global LLM configuration

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

PYSEC-2026-3816 Cognee allows non-superusers to overwrite global LLM configuration

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

Cognee allows non-superusers to overwrite global LLM configuration

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

GHSA-49F7-WHX5-4256 Cognee allows non-superusers to overwrite global LLM configuration

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

CVE-2026-58473 Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

Server-side Request Forgery (SSRF)

Overview Crawl4AI is a 🚀🤖 Crawl4AI: Open-source LLM Friendly Web Crawler & scraper Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the baseurl parameter in API requests and the resolution of environment variables in the LLM configuration process. An attack...