CVE-2026-19369

A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component addattachmentfrompublicurl. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The proje...

CVE-2026-19369 KS-GEN-AI jira-mcp-server add_attachment_from_public_url index.ts axios.get server-side request forgery

A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component addattachmentfrompublicurl. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The proje...

CVE-2026-19369

The CVE concerns KS-GEN-AI jira-mcp-server 0.2.0. It affects the add_attachment_from_public_url path in src/index.ts, specifically the function axios.get. Maliciously manipulating the imageUrl parameter enables server-side request forgery (SSRF) and requires a local attack. Exploit maturity is sh...

CVE-2026-16942

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for...

EUVD-2026-53111

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for...

CVE-2026-69089

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource. Because the file:// scheme branch only lexically collapses '..' segments without a...

CVE-2026-63429 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, POST /api/upload has no authentication guard, no global guard, no form-context validation, no openToken requirement, and no session cookie check. Any anonymous internet user can upload files PDF, DOC/DOCX, XLS/XLSX, CSV, TXT, MP...

CVE-2026-63429

HeyForm is an open-source form builder with a vulnerable endpoint: before 3.0.0-rc.9, POST /api/upload has no authentication, guards, form-context validation, openToken requirement, or session cookie check. Any anonymous internet user can upload various file types (up to 10 MB) and receive a perm...

CVE-2026-61646

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing the request to axios, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an...

GHSA-XW9Q-2MV6-9FR8 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Summary Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the current IPv4 validation logic appears incomplete. The validatePublicUrl protection relies on isValidPublicIPv4Address to...

EUVD-2026-36132

Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges...

CVE-2026-27779

Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation...

EUVD-2026-41637

Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation...

CVE-2026-27779 Gitea forwarded-proto handling allows public URL spoofing

Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation...

CVE-2026-50131

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting...

CVE-2026-50131 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting...

CVE-2026-50131 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting...

CVE-2026-50131 Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting...

PT-2026-48548

Name of the Vulnerable Software and Affected Versions Fedify versions 0.11.2 through 1.9.11 Fedify versions 0.11.2 through 1.10.10 Fedify versions 0.11.2 through 2.0.18 Fedify versions 0.11.2 through 2.1.14 Fedify versions 0.11.2 through 2.2.3 Description Fedify is a TypeScript library for buildi...

PT-2026-47722

Name of the Vulnerable Software and Affected Versions Slider Revolution versions prior to 7.0.11 Description The plugin is subject to sensitive information disclosure resulting from three design flaws. First, a valid backend AJAX nonce revslider actions is leaked to all authenticated users,...