CVE-2026-55096

The fast-mcp-telegram Telegram MCP Server is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 30.1 . The send_message and send_message_to_phone tools allow users to provide HTTP(S) URLs for file downloads. The vulnerability exists because the _validate_url_security function...

CVE-2026-40160: Server-Side Request Forgery (SSRF)

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, webcrawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get with followredirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints...