CVE-2026-19751

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-19751 EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

USN-8638-1: Axios vulnerabilities

Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NOPROXY rules. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. CVE-2025-62718 It was discovered that Axios did...

CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

EUVD-2026-58198

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...

CVE-2026-58314

Two SSRF findings in Gitea 1.26.2...

CVE-2026-58314

The Git repository management system Gitea (specifically version 1.26.2 ) is vulnerable to Server-Side Request Forgery (SSRF) due to incorrect calculations in the *HostMatchList.checkIP() function within modules/hostmatcher/hostmatcher.go and the RedirectURL() function in modules/auth/openid/open...

CVE-2026-58314 Two SSRF findings in Gitea 1.26.2

Two SSRF findings in Gitea 1.26.2...

CVE-2026-66704

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...

EUVD-2026-57907

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

CVE-2026-66704 WordPress Gutenverse Companion plugin <= 2.5.1 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

EUVD-2026-57893

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

JLSEC-2026-1284

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes curl extract information about services that are otherwise...

CVE-2026-18699

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:31+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

CVE-2026-18694

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:19+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

CVE-2026-46382

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

PT-2026-71892

Name of the Vulnerable Software and Affected Versions EnzoVezzaro mcp-dominican-layer versions up to 39dd373786712650097ad31db27d5c477c8f9c82 Description An issue exists in the PDF Parsing component within the parse-pdf function of the src/index.ts file. A remote attacker can manipulate the pdfUr...

PT-2026-71797

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

PT-2026-71893

Name of the Vulnerable Software and Affected Versions mcp-rdf-explorer version 1.0.0 Description A server-side request forgery SSRF issue exists in the MCP Server component within the explore url function of the src/mcp-rdf-explorer/server.py file. A remote attacker can trigger this by manipulati...