CVE-2026-54689

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...

PYSEC-2026-2986 pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

Impact OGC API - Process execution requests can use the subscriber object to requests to internal HTTP services. Patches The issue has been patched in master branch and made available as part of the 0.23.3 release. The patch disables any HTTP requests made to internal resources by default unless...

WS-2021-0040

In highcharts-export-server before version 2.1.0 there is a vulnerability that allows exposure of internal HTTP resources. The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is expos...

PT-2026-33304

The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files...

CVE-2026-27759: Server-Side Request Forgery (SSRF)

Featured Image from Content featured-image-from-content WordPress plugin versions prior to 1.7 contain an authenticated server-side request forgery vulnerability that allows Author-level users to fetch internal HTTP resources. Attackers can exploit insecure URL fetching and file write operations ...

EUVD-2019-0343

Malware in sbrugna...

EUVD-2018-0262

Malware in sbrugna...

EUVD-2019-0289

Malware in sbrugna...

EUVD-2018-0250

Malware in sbrugna...

EUVD-2019-0350

Malware in sbrugna...

EUVD-2022-2343

Malicious code in bioql PyPI...

CVE-2024-50342

CVE-2024-50342 concerns Symfony’s http-client NoPrivateNetworkHttpClient leaking host resolution information, enabling possible IP/port enumeration. Affected versions before the fix include 5.4.46, 6.4.14, and 7.1.7. The underlying issue was mitigated by updating NoPrivateNetworkHttpClient to fil...

CVE-2024-50342 Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port...

MAL-2023-509 Malicious code in http-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db39987d6a5793a748c90045d86f1464d80c1542227b575b2e57e78fc95a1ee1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

get-token-user10 (0.10.1) potentially affected by unknown CVE via http-resources (0.0.1-security)

http-resources NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on http-resources and may be impacted: - get-token-user10 0.10.1 Source cves: unknown CVE Source advisory: GHSA-V6QG-Q2FH-R23R...

get-token-user10 (0.10.1) potentially affected by unknown CVE via http-resources (0.0.1-security)

http-resources NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on http-resources and may be impacted: - get-token-user10 0.10.1 Source cves: unknown CVE Source advisory: OSV:MAL-2023-509...

SUSE CVE-2017-7835

Mixed content blocking of insecure HTTP sub-resources in a secure HTTPS document was not correctly applied for resources that redirect from HTTPS to HTTP, allowing content that should be blocked, such as scripts, to be loaded on a page. This vulnerability affects Firefox 57...

Exposure of Resource to Wrong Sphere in Spring Data REST

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

Spring Data Commons < 1.13.11 / 2.x < 2.0.6 RCE

The version of Spring Data Commons installed on the remote host is affected by a remote code execution vulnerability. Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of...

Security Restriction Bypass

spring-boot-actuator is vulnerable to security restriction bypass. Lack of secure handling of HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping causes the exposure of those resources and request mapping, leading to...