CVE-2024-21546

UniSharp Laravel Filemanager Unauthenticated RCE CVE-2024-21546 This repository contains security assessment tooling, detection templates, and an automated exploit toolkit for identifying and exploiting Unauthenticated Remote Code Execution RCE in applications utilizing the...

SUSE CVE-2026-115700

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Summary Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not ...

CVE-2026-115700

The benoitc hackney library (versions 4.0.1 to 4.8.x ) is vulnerable to Server-Side Request Forgery (SSRF) due to an Interpretation Conflict in hackney_url. Specifically, the hackney_url:normalize/2 function fails to block percent-encoded bracketed IPv6 literals (e.g., %5B%3A%3Affff%3A127%2E0%2E0...

CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

CVE-2026-115751 mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

CVE-2026-115751

The Agentfront mcp-from-openapi package (versions 2.2.0 through 2.8.x ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is an incomplete list of disallowed inputs, where the ssrf.blockedHosts denylist can be bypassed using trailing-dot hostnames . An attacker who controls a...

EUVD-2026-108959

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

CVE-2026-115751 mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

CVE-2026-115751

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

PT-2026-122083

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked...

DoS (Denial of Service) axios Dependency in Jira Service Management Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.22 and 11.3.5 of Jira Service Management Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticat...

DoS (Denial of Service) axios Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.22 and 11.3.7 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacke...

Oracle Linux 9 : curl (ELSA-2026-80511)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-80511 advisory. - fix cookie injection via trailing dot super cookies CVE-2026-8924 Tenable has extracted the preceding description block directly from the Oracle Lin...

CVE-2026-57441 MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On...

CVE-2026-57441 MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On...

CVE-2026-57441 MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On...

Fedora 43 : curl (2026-097fb2e7e9)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-097fb2e7e9 advisory. - fix cross-proxy Digest auth state leak CVE-2026-7168 - fix cross-origin Digest auth state leak CVE-2026-11856 - fix password leak with netrc and...