CVE-2026-73231

A flaw was found in Faker, a library for generating fake data. The faker.helpers.fake method allows an attacker to control fake templates, which can then access the Function constructor. This access, specifically through fakeEval.resolveProperty when a function returns another function, enables...

CVE-2026-19751

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-19752

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is...

CVE-2026-19753

A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function exploreurl of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be...

CVE-2026-19753

The CVE-2026-19753 entry concerns MCP Server’s MCP-rdf-explorer 1.0.0, specifically the explore_url function in src/mcp-rdf-explorer/server.py. A server-side request forgery (SSRF) vulnerability results from manipulating the url argument, with the attack described as potentially remotely initiabl...

CVE-2026-19753 Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery

A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function exploreurl of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be...

CVE-2026-19753 Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery

A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function exploreurl of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be...

CVE-2026-19752 EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is...

CVE-2026-19752 EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is...

CVE-2026-19752

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is...

CVE-2026-19752

CVE-2026-19752 affects EnzoVezzaro’s mcp-dominican-layer (PDF Parsing), specifically the parse-pdf function in src/index.ts. A manipulation of the pdfUrl argument enables remote server-side request forgery (SSRF); exploitation is public and can be used. Documents indicate vulnerability details an...

CVE-2026-19751

CVE-2026-19751 affects EnzoVezzaro mcp-dominican-layer (parse-csv tool). The flaw resides in src/index.ts, where axios.get is invoked with a manipulated csvUrl, enabling server-side request forgery. Exploitation is remote and a PoC exploit has been published. The project uses a rolling release st...

CVE-2026-19751 EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-19751

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

Malicious code in webautomation_js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5 index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a...

MAL-2026-13991 Malicious code in webautomation_js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e679284d7396f5ac4f7248839fa3704a2c72bcec08c100267b5980cd2a0d5 index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a...

CVE-2026-19748

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManagerParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument...

GHSA-M42H-3232-VPV3 nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

Summary nltk.data.load and nltk.data.find resolve user-supplied resource names to filesystem paths using url2pathname, which decodes percent-encoded sequences e.g. %2e%2e to ... Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e...

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

Summary nltk.data.load and nltk.data.find resolve user-supplied resource names to filesystem paths using url2pathname, which decodes percent-encoded sequences e.g. %2e%2e to ... Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e...

CVE-2026-19746

A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contact...