CVE-2026-7146

A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...

EUVD-2026-25905

A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...

CVE-2026-7146

CVE-2026-7146 affects AlejandroArciniegas mcp-data-vis (up to commit de5a51525a69822290eaee569a1ab447b490746d). The vulnerability targets the function axios in the file src/servers/web-scraper/server.js of the HTTP Request Handler component, enabling server-side request forgery . The description ...

CVE-2026-7146

A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...

CVE-2026-7146 AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery

A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...

MCP Data Visualization & Experimentation Platform Code Issues and Vulnerabilities

MCP Data Visualization & Experimentation Platform is a large model context protocol developed by alejandro and his team. There are code-related vulnerabilities in MCP Data Visualization & Experimentation Platform. These vulnerabilities stem from improper use of the axios function in the...

CVE-2026-7146: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...

PT-2026-35504

A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to...

exchangerates (>=0.3.0, <=0.3.1), lolcomicgrabber (>=0.0.1, <=0.0.3) +4 more potentially affected by CVE-2026-41066 via lxml (4.4.0)

lxml PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - exchangerates =0.3.0, =0.0.1, =0.0.1b1, =0.1.0, =0.2.1 Source cves: CVE-2026-41066 Source advisory: OSV:PYSEC-2026-87...

aio-nxapi (>=0.1.0, <=0.3.0), basketball-reference-web-scraper (>=4.9.4, <=4.13.0) +19 more potentially affected by CVE-2026-41066 via lxml (4.5.1)

lxml PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - aio-nxapi =0.1.0, =4.9.4, =2020.6.3, =3.13.0, =3.7.0, =1.1.5, =2.1.0, =2020.6.3, =2.22.0, =0.1.8, =0.1.5, =3.0.0, =3.0.1 and more Source cves:...

aztarna (1.0.0), gluetool (>=1.25.0, <=1.26.0) +4 more potentially affected by CVE-2026-41066 via lxml (4.2.4)

lxml PYPI version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - aztarna 1.0.0 - gluetool =1.25.0, =1.0.0, =1.0.0, =0.4.1, =1.4.0, =1.5.2 Source cves: CVE-2026-41066 Source advisory: OSV:PYSEC-2026-87...

anadroid (>=0.5.56, <=0.5.59), anomalib (>=0.2.2, <=0.2.4) +88 more potentially affected by CVE-2026-41066 via lxml (4.6.5)

lxml PYPI version 4.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - anadroid =0.5.56, =0.2.2, =0.1.1, =1.1.20, =0.2.0, =5.0.0, =9.1.2, =0.0.1, =0.0.1, =3.0.0, =0.0.0a1, =1.0.0, =0.6.13, =0.0.1, =0.0.26 and more Source...

aioiliad (0.3.1), ansible-playbook-grapher (>=0.8.0, <=0.9.2) +23 more potentially affected by CVE-2026-41066 via lxml (4.2.5)

lxml PYPI version 4.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - aioiliad 0.3.1 - ansible-playbook-grapher =0.8.0, =4.4.1, =0.3.2, =1.2.0, =1.0.0a201811211534, =0.4.1, =0.3.0, =0.9.0, =0.1.1, =1.0.0, =1.0.2 and more...

exchangerates (>=0.3.0, <=0.3.1), lolcomicgrabber (>=0.0.1, <=0.0.3) +4 more potentially affected by CVE-2026-41066 via lxml (4.4.0)

lxml PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - exchangerates =0.3.0, =0.0.1, =0.0.1b1, =0.1.0, =0.2.1 Source cves: CVE-2026-41066 Source advisory: OSV:GHSA-VFMQ-68HX-4JFW...

EUVD-2026-23803

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extractwithbs4/extractwith3k/extractwithlxml of the file superagi/helper/webpageextractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. I...

CVE-2026-6616

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extractwithbs4/extractwith3k/extractwithlxml of the file superagi/helper/webpageextractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. I...

CVE-2026-6616 TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extractwithbs4/extractwith3k/extractwithlxml of the file superagi/helper/webpageextractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. I...

CVE-2026-6616

TransformerOptimus SuperAGI up to version 0.0.14 contains a server-side request forgery in the WebScraperTool’s webpage_extractor.py, affecting functions extract_with_bs4, extract_with_3k, and extract_with_lxml. The issue arises in superagi/helper/webpage_extractor.py and is exploitable remotely;...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-41314 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-41314 Source advisory: OSV:GHSA-X284-J5P8-9C5P...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-41313 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-41313 Source advisory: OSV:GHSA-4PXV-J86V-MHCW...