CVE-2026-12372

A flaw was found in NLTK. A Server-Side Request Forgery SSRF vulnerability allows an attacker to influence a URL passed to NLTK's network-loading helpers. This occurs because the nltk.pathsec.validatenetworkurl function fails to properly identify and reject IP addresses within the RFC 6598 shared...

CVE-2026-12372 Server-Side Request Forgery (SSRF) in nltk/nltk

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

CVE-2026-12372

A Server-Side Request Forgery (SSRF) exists in nltk/nltk versions 3.9.4 and the current develop branch. The function nltk.pathsec.validate_network_url() fails to reject IPs in RFC 6598 shared address space (100.64.0.0/10) because Python’s ipaddress classification does not mark such addresses as i...

CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

CVE-2026-19373

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to...

CVE-2026-19369

A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component addattachmentfrompublicurl. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The proje...

EUVD-2026-54953

A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component addattachmentfrompublicurl. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The proje...

CVE-2026-19369 KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get server-side request forgery

A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component addattachmentfrompublicurl. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The proje...

CVE-2026-19369

The CVE concerns KS-GEN-AI jira-mcp-server 0.2.0. It affects the add_attachment_from_public_url path in src/index.ts, specifically the function axios.get. Maliciously manipulating the imageUrl parameter enables server-side request forgery (SSRF) and requires a local attack. Exploit maturity is sh...

CVE-2026-15534

creationtimestamp| type| source ---|---|--- 2026-08-09 18:53:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/f3q2gpg2kqmci 2026-08-10 03:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117068976931455651 2026-08-10 03:00:27+00:00| seen|...

CVE-2026-19363

creationtimestamp| type| source ---|---|--- 2026-08-09 18:48:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3qfltwirughs3...

CVE-2026-67622

creationtimestamp| type| source ---|---|--- 2026-08-09 16:00:07+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msnxegt2qg2h 2026-08-10 17:18:10+00:00| seen| https://gist.github.com/haidang-infosec/402db84bee7aca2f57bb109b31574649...

CVE-2026-19354

creationtimestamp| type| source ---|---|--- 2026-08-09 14:47:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/a4ovjan3ipnsr...

CVE-2026-15153

creationtimestamp| type| source ---|---|--- 2026-08-09 14:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msnrkhs5la26...

CVE-2026-19340 anubissbe ProjectHub-Mcp Webhooks API complete_backend.js server-side request forgery

A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/completebackend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possibl...

CVE-2026-18603

creationtimestamp| type| source ---|---|--- 2026-08-09 06:31:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/5gu4ns4p4elmp...

CVE-2026-19337 adenot mcp-google-search read_webpage index.ts server-side request forgery

A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component readwebpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This...

CVE-2026-19337

CVE-2026-19337 affects the package adenot mcp-google-search up to version 0.3.1. The vulnerability is in an unknown function within src/index.ts of the component read_webpage , enabling server-side request forgery (SSRF) through manipulation of the url argument. The attack is described as restric...

CVE-2026-10595 Path Traversal Vulnerability in parisneo/lollms

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in backend/routers/ui.py. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without...