CVE-2026-19984 jkawamoto mcp-florence2 __init__.py get_images server-side request forgery

A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...

CVE-2026-19984

CVE-2026-19984 affects jkawamoto/mcp-florence2 (up to 0.3.13). The vulnerability is in the get_images function of src/mcp_florence2/init .py where the src argument is manipulated, enabling server-side request forgery (SSRF). The issue can be triggered remotely and a PoC exploit has been published...

CVE-2026-2711

A vulnerability has been found in zhutoutoutousan worldquant-miner up to 1.0.9. The impacted element is an unknown function of the file worldquant-miner-master/agent-dify-api/core/helper/ssrfproxy.py of the component URL Handler. The manipulation of the argument makerequest leads to server-side...

CVE-2026-2711 zhutoutoutousan worldquant-miner URL ssrf_proxy.py server-side request forgery

A vulnerability has been found in zhutoutoutousan worldquant-miner up to 1.0.9. The impacted element is an unknown function of the file worldquant-miner-master/agent-dify-api/core/helper/ssrfproxy.py of the component URL Handler. The manipulation of the argument makerequest leads to server-side...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2025-2415)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications...

EulerOS 2.0 SP10 : httpd (EulerOS-SA-2025-2387)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications...

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRF

The theme and plugin have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF Server Side Request Forgery and RFI Remote File Inclusion vulnerabilities on...