CVE-2026-108787 houtini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery

A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collectcorpus. Performing a manipulation of the argument sitemapurl results in server-side request forgery. Remote exploitation of t...

CVE-2026-108787

A server-side request forgery (SSRF) vulnerability exists in houtini-ai voice-analyser-mcp up to version 2.1.1 . The flaw is located in the fetch function within the src/utils/crawler.ts file of the collect_corpus component. By manipulating the sitemap_url argument, an attacker can perform remote...

CVE-2026-108786

A vulnerability exists in houtini-ai seo-crawler-mcp up to version 2.1.5 within the Crawler component. The flaw resides specifically in the run_seo_audit function located in the src/core/CrawlOrchestrator.ts file. This vulnerability allows for server-side request forgery (SSRF) and can be launche...

CVE-2026-108786 houtini-ai seo-crawler-mcp Crawler CrawlOrchestrator.ts run_seo_audit server-side request forgery

A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function runseoaudit of the file src/core/CrawlOrchestrator.ts of the component Crawler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been...

PT-2026-110553

Name of the Vulnerable Software and Affected Versions Ollama versions prior to 0.34.2 Description An issue exists in the Pull API where the IsValid function within the types/model/name.go file fails to properly validate model names. This allows a remote attacker to provide crafted input that...

CVE-2026-108770

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...

CVE-2026-108770 Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request...

CVE-2026-64849-poc-lab

Security Lab — SSRF Exploitation in MLflow Webhooks CVE-2026-64849 · MLflow Restricted use: lab material, only for authorized networks and environments. See Legal notice. 1. Executive summary Attribute| Value ---|--- Vulnerability| CVE-2026-64849 — SSRF via Webhook Redirect Bypass Affected...

CVE-2026-108741

Shepherd shepherd-ai through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the publicurl guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and...

CVE-2026-108572

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from...

CVE-2026-108572 Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from...

CVE-2026-108572 Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from...

CVE-2026-108572

A server-side request forgery (SSRF) vulnerability exists in Casdoor up to versions 3.164.0 and 4.10.0 . The flaw is located in the CasP3ProxyValidate function within the controllers/cas.go file of the Proxy Validation component. An attacker can remotely manipulate the pgtUrl argument to trigger ...

CVE-2026-108542

A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in server-side request forgery. The attack can be executed remotel...

CVE-2026-108542 021is elvix-sdk MCP Request index.ts server-side request forgery

A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of the component MCP Request Handler. The manipulation of the argument path results in server-side request forgery. The attack can be executed remotel...

CVE-2026-108542

A server-side request forgery (SSRF) vulnerability exists in the 021is elvix-sdk up to version 0.10.1 . The flaw is located within an unknown functionality of the src/mcp/index.ts file in the MCP Request Handler component. By manipulating the argument path , an attacker can execute the attack rem...

lazyrecon

| | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 es una herramienta de descubrimiento de subdominios que encuentra y resuelve subdominios válidos y luego realiza fuzzing de SSRF/LFI/SQLi, fuerza bruta y escaneo de puertos. Tiene una...

CVE-2026-108523 Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repourl can lead to server-side request forgery. The attack may be...

CVE-2026-108523 Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repourl can lead to server-side request forgery. The attack may be...

CVE-2026-108523

The Studio-Saelix Sencho software (up to version 0.94.1 ) contains a Server-Side Request Forgery (SSRF) vulnerability in the git-sources Browse API Endpoint component, specifically affecting the outboundTarget.ts file. Manipulation of the repo_url argument can trigger the SSRF, which may be execu...