CVE-2026-19964

A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jijmcp/pythonrepr.py of the component jmcheck. The manipulation of the argument code results in code injection. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-19964

The CVE-2026-19964 entry concerns Jij-Inc Jij-MCP-Server 0.1.0. It affects the PythonREPL.run function in jij_mcp/python_repr.py (component jm_check). The manipulation of the argument code leads to code injection, with remote exploit potential. The vulnerability has been publicly disclosed, and a...

CVE-2026-19957

A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is...

CVE-2026-19957

A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is...

CVE-2026-19957 graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery

A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is...

CVE-2026-19957

The CVE concerns graphlit-mcp-server 1.0.1, specifically the ssrf-test Endpoint’s src/tools.ts fetch function. The root cause is manipulation of the url argument, enabling server-side request forgery (SSRF). Reported attack vector is network, with low attack complexity and no user interaction req...

CVE-2026-19956

A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...

CVE-2026-19956

The CVE-2026-19956 entry concerns gomarble-ai facebook-ads-mcp-server (version 0.1.0). The vulnerable element is fetch_pagination_url in server.py, whose manipulation enables server-side request forgery. Impact is implied as remote exploitable via the affected function, affecting confidentiality/...

EUVD-2026-59992

A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...

CVE-2026-19956 gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery

A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...

CVE-2026-19956

A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...

VMWare Workspace ONE UEM - Server-Side Request Forgery

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

Spring Cloud Config Server - Local File Inclusion

Spring Cloud Config Server versions 2.1.x prior to 2.1.2, 2.0.x prior to 2.0.4, 1.4.x prior to 1.4.6, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files. An attacker can send a request using a specially...

Hitachi Pentaho Business Analytics Server - Remote Code Execution

Hitachi Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, is susceptible to remote code execution via server-side template injection. Certain web services can set property values which contain Spring templates that are interpreted downstream, thereby...

Oracle E-Business Suite - Server-Side Request Forgery

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite component: Runtime UI. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. id:...

Zoho ManageEngine OpManger - Arbitrary File Read

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. id: CVE-2020-12116 info: name: Zoho ManageEngine OpManger - Arbitrary File Read author:...

MINI-8GX5-2V7C-GG65

Bulletin has no description...

CVE-2026-19728

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The Extra Product Options Builder for...

CVE-2026-17123

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

GO-2026-6222 vulnerabilities

Vulnerabilities for packages: seaweedfs-rocksdb-fips, seaweedfs-rocksdb, kitty, seaweedfs-operator, kubescape, mailpit-fips, rclone, kubescape-server, fortio-fips, seaweedfs-operator-fips, mailpit, gitea, gitea-fips, bento, seaweedfs, kubescape-server-fips, mattermost-fips, rclone-fips, ollama,...