CVE-2026-81093

Apify Actors MCP Server before version 0.9.12 is vulnerable to Server-Side Request Forgery (SSRF) via the get-html-skeleton tool. The URL validation function (isValidHttpUrl) in src/utils/generic.ts confirmed only that the argument began with an http/https scheme and parsed as a URL, without insp...