305187 matches found
PT-2026-72066
Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.112 Description The ckan get mqa quality and ckan get mqa quality details functions in src/tools/quality.ts use the isValidMqaServer function to validate the server url parameter. Because the validation us...
VulnCheck KEV: CVE-2026-45298
Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...
org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation
A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...
CVE-2026-19753
A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function exploreurl of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be...
GHSA-QM8R-Q3H4-C3VW
creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...
CVE-2026-72855
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...
CVE-2026-19752
A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is...
CVE-2026-19753
The CVE-2026-19753 entry concerns MCP Server’s MCP-rdf-explorer 1.0.0, specifically the explore_url function in src/mcp-rdf-explorer/server.py. A server-side request forgery (SSRF) vulnerability results from manipulating the url argument, with the attack described as potentially remotely initiabl...
CVE-2026-19753 Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery
A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function exploreurl of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be...
CVE-2026-73489
Summary: CVE-2026-73489 affects russh (Rust SSH library) prior to 0.62.4. An authenticated SSH client can trigger a denial-of-service by sending a pty-req channel request with more than 130 terminal-mode records. The parser uses a fixed 130-entry array for terminal modes but increments the index ...
CVE-2026-73489
Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry...
CVE-2026-19752
CVE-2026-19752 affects EnzoVezzaro’s mcp-dominican-layer (PDF Parsing), specifically the parse-pdf function in src/index.ts. A manipulation of the pdfUrl argument enables remote server-side request forgery (SSRF); exploitation is public and can be used. Documents indicate vulnerability details an...
CVE-2026-72855 Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...
CVE-2026-72855
Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...
CVE-2026-19751
CVE-2026-19751 affects EnzoVezzaro mcp-dominican-layer (parse-csv tool). The flaw resides in src/index.ts, where axios.get is invoked with a manipulated csvUrl, enabling server-side request forgery. Exploitation is remote and a PoC exploit has been published. The project uses a rolling release st...
CVE-2026-19751 EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery
A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...
Exploit for Path Traversal in Apache Http_Server
Портфолио. Усольцев Глеб Студент 2 курса, Институт компьютерн...
CVE-2026-18671 IBM i is Affected By Multiple Vulnerabilities in NetServer
IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in request processing. The attacker could exploit this vulnerability to cause a temporary denial of service...
CVE-2026-17272 IBM i is Affected By a Denial of Service in HTTP Server []
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow...
CVE-2026-72676
Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...