CVE-2026-19765

A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSource of the file src/utils/swagger-parser.ts of the component fetchswagger. Performing a manipulation results in server-side request forgery...

PT-2026-72055

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in...

VulnCheck KEV: CVE-2026-45298

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

GHSA-QM8R-Q3H4-C3VW

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

CVE-2026-72855

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...

CVE-2026-19752

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is...

CVE-2026-19753

The CVE-2026-19753 entry concerns MCP Server’s MCP-rdf-explorer 1.0.0, specifically the explore_url function in src/mcp-rdf-explorer/server.py. A server-side request forgery (SSRF) vulnerability results from manipulating the url argument, with the attack described as potentially remotely initiabl...

CVE-2026-19753 Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery

A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function exploreurl of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be...

CVE-2026-19752

CVE-2026-19752 affects EnzoVezzaro’s mcp-dominican-layer (PDF Parsing), specifically the parse-pdf function in src/index.ts. A manipulation of the pdfUrl argument enables remote server-side request forgery (SSRF); exploitation is public and can be used. Documents indicate vulnerability details an...

CVE-2026-72855 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...

CVE-2026-72855

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...

CVE-2026-19751 EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-19751

CVE-2026-19751 affects EnzoVezzaro mcp-dominican-layer (parse-csv tool). The flaw resides in src/index.ts, where axios.get is invoked with a manipulated csvUrl, enabling server-side request forgery. Exploitation is remote and a PoC exploit has been published. The project uses a rolling release st...

CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

EUVD-2026-58198

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...

CVE-2026-58314

Two SSRF findings in Gitea 1.26.2...

CVE-2026-58314 Two SSRF findings in Gitea 1.26.2

Two SSRF findings in Gitea 1.26.2...

CVE-2026-58314

CVE-2026-58314 _ Two SSRF findings in Gitea 1.26.2. The NVD entry reports two SSRF vulnerabilities in Gitea 1.26.2 with CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N and a base score of 7.7 (HIGH). The connected sources also reference public advisories and a later release addressi...

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...