624 matches found
cyclone (>=1.2.0, <=1.3.0), ironman (>=0.5.0, <=0.6.0) +5 more potentially affected by CVE-2026-42304 via twisted (19.2.1)
twisted PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - cyclone =1.2.0, =0.5.0, =4.0.1, =1.0.0, =0.1.0a23, =0.1.0, =0.2.1 Source cves: CVE-2026-42304 Source advisory: OSV:PYSEC-2026-160...
Identifying AI Web Scrapers Using Canary Tokens
From pre-training to query-time augmentation, web-scraped data helps to improve the quality and contextual relevancy of content generated by large language models LLMs. However, large-scale web scraping to feed LLMs can affect site stability and raise legal, privacy, or ethics concerns. If websit...
CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...
cyclone (>=1.2.0, <=1.3.0), ironman (>=0.5.0, <=0.6.0) +5 more potentially affected by CVE-2026-42304 via twisted (19.2.1)
twisted PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - cyclone =1.2.0, =0.5.0, =4.0.1, =1.0.0, =0.1.0a23, =0.1.0, =0.2.1 Source cves: CVE-2026-42304 Source advisory: OSV:GHSA-GRGV-6HW6-V9G4...
9gag-scraper (>=0.0.6, <=0.0.7), agora-community-sdk (>=0.1.7, <=0.1.10) +142 more potentially affected by CVE-2026-42308 via pillow (6.2.2)
pillow PYPI version 6.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 9gag-scraper =0.0.6, =0.1.7, =0.0.1.dev1, =0.1.0, =0.1.0, =1.0.0, =0.26.0.dev2, =0.0.1, =20.1.1, =2.0.0, =3.0.2, =0.16.0, =0.18.2 - colornet 0.2.0 a...
dcicsnovault (>=2.0.0b4, <=4.0.0b2), django-dynamic-scraper (>=0.11.4, <=0.13.1) +12 more potentially affected by CVE-2026-42308 via pillow (3.4.2)
pillow PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - dcicsnovault =2.0.0b4, =0.11.4, =0.18.1, =0.6.12a2, =0.9.0, =0.2.1, =0.0.3, =1.6.0, =1.4.0, =1.12.0 - yulelog 0.0.3 Source cves: CVE-2026-42308 Sour...
CVE-2026-7146
A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...
CVE-2026-7146 AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery
A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...
CVE-2026-7146
CVE-2026-7146 affects AlejandroArciniegas mcp-data-vis (up to commit de5a51525a69822290eaee569a1ab447b490746d). The vulnerability targets the function axios in the file src/servers/web-scraper/server.js of the HTTP Request Handler component, enabling server-side request forgery . The description ...
CVE-2026-7146
A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...
EUVD-2026-25905
A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...
CVE-2026-7146
A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...
PT-2026-35504
A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...
MCP Data Visualization & Experimentation Platform Code Issues and Vulnerabilities
MCP Data Visualization & Experimentation Platform is a large model context protocol developed by alejandro and his team. There are code-related vulnerabilities in MCP Data Visualization & Experimentation Platform. These vulnerabilities stem from improper use of the axios function in the...
CVE-2026-7146: Server-Side Request Forgery (SSRF)
A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...
aio-nxapi (>=0.1.0, <=0.3.0), basketball-reference-web-scraper (>=4.9.4, <=4.13.0) +19 more potentially affected by CVE-2026-41066 via lxml (4.5.1)
lxml PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - aio-nxapi =0.1.0, =4.9.4, =2020.6.3, =3.13.0, =3.7.0, =1.1.5, =2.1.0, =2020.6.3, =2.22.0, =0.1.8, =0.1.5, =3.0.0, =3.0.1 and more Source cves:...
aztarna (1.0.0), gluetool (>=1.25.0, <=1.26.0) +4 more potentially affected by CVE-2026-41066 via lxml (4.2.4)
lxml PYPI version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - aztarna 1.0.0 - gluetool =1.25.0, =1.0.0, =1.0.0, =0.4.1, =1.4.0, =1.5.2 Source cves: CVE-2026-41066 Source advisory: OSV:PYSEC-2026-87...
exchangerates (>=0.3.0, <=0.3.1), lolcomicgrabber (>=0.0.1, <=0.0.3) +4 more potentially affected by CVE-2026-41066 via lxml (4.4.0)
lxml PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - exchangerates =0.3.0, =0.0.1, =0.0.1b1, =0.1.0, =0.2.1 Source cves: CVE-2026-41066 Source advisory: OSV:PYSEC-2026-87...
anadroid (>=0.5.56, <=0.5.59), anomalib (>=0.2.2, <=0.2.4) +88 more potentially affected by CVE-2026-41066 via lxml (4.6.5)
lxml PYPI version 4.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - anadroid =0.5.56, =0.2.2, =0.1.1, =1.1.20, =0.2.0, =5.0.0, =9.1.2, =0.0.1, =0.0.1, =3.0.0, =0.0.0a1, =1.0.0, =0.6.13, =0.0.1, =0.0.26 and more Source...