PT-2025-51161

Name of the Vulnerable Software and Affected Versions D-Link DIR-860LB1 version 203b01 D-Link DIR-868LB1 version 203b01 D-Link DIR-860LB1 version 203b03 D-Link DIR-868LB1 version 203b03 Description A flaw exists in the DHCP Daemon component of the routers. Manipulation of the Hostname argument ca...

Man-In-The-Middle (MITM) Attack

MQTT is vulnerable to a Man-in-the-Middle MITM attack. The vulnerability is due to missing hostname verification by default, which allows an attacker to intercept and manipulate communication between clients and servers...

Improper SSL Hostname Verification

org.springframework.boot, spring-boot-autoconfigure is vulnerable to improper SSL hostname verification. The vulnerability is due to missing hostname verification in Cassandra SSL auto-configuration, which allows an attacker to perform man-in-the-middle attacks by intercepting and spoofing truste...

Improper Certificate Validation

org.codehaus.mevenide, netbeans is vulnerable to improper certificate validation. The vulnerability is due to the autoupdate system failing to validate SSL certificates and hostnames for HTTPS-based downloads, which allows an attacker to intercept and modify autoupdate packages and potentially...

Improper Certificate Validation

com.squareup.okhttp3, okhttp is vulnerable to improper certificate validation. The vulnerability is due to improper use of cryptographic hostname verification in verifyHostName, which allows an attacker to present a certificate for an incorrect domain and potentially perform remote information...

Security Bulletin: Vulnerabilities in Fasterxml Jackson,FasterXML Jackson Core,Bouncy Castle Java, Netty,Hibernate Validator,JCraft JSch,Apache Tomcat,Bootstrap might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in Fasterxml Jackson,FasterXML Jackson Core,Bouncy Castle Java, Netty,Hibernate Validator,JCraft JSch,Apache Tomcat,Bootstrap.Vulnerabilities include Jackson-Modules-Java8 that can result in Causes a...

OESA-2025-2829 golang security update

. Security Fixes: Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a...

OESA-2025-2825 golang security update

. Security Fixes: Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a...

CVE-2025-65288

A buffer overflow in the Mercury MR816v2 081C3114 4.8.7 Build 110427 Rel 36550n occurs when the device accepts and stores excessively long hostnames from LAN hosts without proper length validation. The affected code performs unchecked copies/concatenations into fixed-size buffers. A crafted long...

CVE-2025-65512

A Server-Side Request Forgery SSRF vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vulnerability allows an attacker to bypass private IP restrictions through hostname-based bypass and HTTP redirect chains, enabling access to...

CVE-2025-61729

Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can...

EUVD-2025-202627

A Server-Side Request Forgery SSRF vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vulnerability allows an attacker to bypass private IP restrictions through hostname-based bypass and HTTP redirect chains, enabling access to...

CVE-2025-65512

A Server-Side Request Forgery SSRF vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vulnerability allows an attacker to bypass private IP restrictions through hostname-based bypass and HTTP redirect chains, enabling access to...

CVE-2025-65512

A Server-Side Request Forgery SSRF vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vulnerability allows an attacker to bypass private IP restrictions through hostname-based bypass and HTTP redirect chains, enabling access to...

CVE-2025-65512

Markdownify MCP Server vulnerability CVE-2025-65512 affects markdownify-mcp v0.0.2 and earlier. The flaw is a Server-Side Request Forgery (SSRF) in the webpage-to-markdown conversion feature that can bypass private IP restrictions via hostname-based bypass and HTTP redirect chains, enabling acces...

PT-2025-50494

Name of the Vulnerable Software and Affected Versions markdownify-mcp versions prior to 0.0.3 Description A Server-Side Request Forgery SSRF issue exists in the webpage-to-markdown conversion feature. This allows an attacker to circumvent private IP restrictions using hostname-based bypass and HT...

CVE-2025-65512

A Server-Side Request Forgery SSRF vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vulnerability allows an attacker to bypass private IP restrictions through hostname-based bypass and HTTP redirect chains, enabling access to...

Server-side Request Forgery (SSRF)

Overview mcp-fetch-server is an An MCP server offering simple HTTP fetch functionality Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetch method, in the isipprivate function. An attacker can access internal network resources by sending crafted...

EUVD-2025-202296

A stored Cross site scripting XSS vulnerability in the Mercury MR816v2 081C3114 4.8.7 Build 110427 Rel 36550n router allows a remote attacker on the LAN to inject JavaScript into the router's management UI by submitting a malicious hostname. The injected script is stored and later executed in the...

CVE-2025-65289

A stored Cross site scripting XSS vulnerability in the Mercury MR816v2 081C3114 4.8.7 Build 110427 Rel 36550n router allows a remote attacker on the LAN to inject JavaScript into the router's management UI by submitting a malicious hostname. The injected script is stored and later executed in the...