CVE-2026-90971

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

CVE-2026-90971

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

CVE-2026-90971

A Server-Side Request Forgery (SSRF) vulnerability exists in the VMware synchronization feature of Devolutions Server version 2026.2.16 and earlier . A low-privileged authenticated user can exploit this by submitting a crafted connection definition during datacenter discovery. This flaw allows th...

CVE-2026-90971

Server-Side Request Forgery SSRF in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for...

CVE-2026-58485

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

CVE-2026-54688

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

CVE-2026-54689

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...

CVE-2026-19504

Fabric.js is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the loadFromJSON method. The root cause is a lack of proper URI validation before accessing resources, allowing remote attackers to gain improper access to network resources and potentially disclose sensitive information. Exp...

CVE-2026-19504 Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...

EUVD-2026-79129

Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...

CVE-2026-58485 mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

CVE-2026-58485 mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

EUVD-2026-78924

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

CVE-2026-58485

mcp-searxng , a Model Context Protocol server providing AI assistants web search and URL-reading via SearXNG, is vulnerable to Server-Side Request Forgery (SSRF) in the web_url_read tool prior to version 1.7.1 . The assertUrlAllowed() function in src/url-reader.ts performs only a lexical hostname...

CVE-2026-58485 mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

CVE-2026-54688 mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

EUVD-2026-78923

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

CVE-2026-54688 mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

CVE-2026-54688 mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

CVE-2026-54688

CVE-2026-54688 is a Server-Side Request Forgery (SSRF) in mcp-searxng , a Model Context Protocol server providing AI assistants with web search and URL-reading via SearXNG. Prior to 1.2.0 , the web_url_read tool passes a caller-supplied URL to a server-side fetch path, but the internal-address gu...