utcp-http vulnerable to SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

Summary The utcp-http plugin is vulnerable to a blind Server-Side Request Forgery SSRF caused by a trust-boundary inconsistency between manual discovery and tool invocation. registermanual validates the discovery URL against an HTTPS / loopback allowlist, but calltool and calltoolstreaming reuse...

CVE-2026-8142

creationtimestamp| type| source ---|---|--- 2026-05-07 22:07:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlca2zkgkf2q...

CVE-2026-39836

creationtimestamp| type| source ---|---|--- 2026-05-07 22:02:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlc7s2lbje2v 2026-05-08 12:01:27+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mldoo2vosj2d 2026-05-15 16:19:42+00:00| seen|...

CVE-2026-42449

creationtimestamp| type| source ---|---|--- 2026-05-07 21:51:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlc75hcav22e 2026-05-07 23:50:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlcftqxeo72p 2026-05-18 02:07:08+00:00| seen|...

CVE-2026-3477

creationtimestamp| type| source ---|---|--- 2026-05-07 21:33:05+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mlc65d5hxu2i...

CVE-2026-42501

creationtimestamp| type| source ---|---|--- 2026-05-07 21:23:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlc5lyf2ry2c...

CVE-2026-44742

creationtimestamp| type| source ---|---|--- 2026-05-07 21:19:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlc5eyncrc2r 2026-06-19 12:45:12+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/e6ba9994-41dc-45f7-b8e9-ac330a61d59b 2026-06-23...

CVE-2026-8034

CVE-2026-8034 is a server-side request forgery (SSRF) vulnerability in the GitHub Enterprise Server notebook viewer. The issue stems from URL parser confusion between the validation layer and the HTTP request library, where hostname validation uses a different parser than the request library, all...

CVE-2026-8034

A server-side request forgery SSRF vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a differe...

CVE-2026-8034 Server-side request forgery vulnerability in GitHub Enterprise Server notebook viewer via URL parser confusion

A server-side request forgery SSRF vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a differe...

CVE-2026-44243

creationtimestamp| type| source ---|---|--- 2026-05-07 21:17:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlc5bswnv72i 2026-05-12 21:03:25+00:00| seen| https://gist.github.com/trippersham/98c56220f8edca1dd84337d7c1d67182...

CVE-2026-41691

Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL templat...

CVE-2026-41692

i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute key interpolation tokens inside src and href attribute values with the raw string returned by i18next.t. The substitution logic in...

Server-side Request Forgery (SSRF)

Overview nuxt-og-image is an Enlightened OG Image generation for Nuxt. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to inadequate validation of user-supplied URLs in the isBlockedUrl process. An attacker can access internal network resources or sensitiv...

nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)

Summary The isBlockedUrl denylist introduced in [email protected] to remediate GHSA-pqhr-mp3f-hrpp Dmitry Prokhorov / Positive Technologies, March 2026 is incomplete. The patch advisory states "Decimal/hexadecimal IP encoding bypasses are also handled" — that part is true Node's WHATWG URL pars...

CVE-2026-42449 n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In versions 2.47.4 through 2.47.13, the SDK embedder path N8NDocumentationMCPServer constructor, getN8nApiClient, and validateInstanceContext, the synchronous URL validator in...

CVE-2026-42449 n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. In versions 2.47.4 through 2.47.13, the SDK embedder path N8NDocumentationMCPServer constructor, getN8nApiClient, and validateInstanceContext, the synchronous URL validator in...

CVE-2026-42449

Summary: CVE-2026-42449 affects n8n-mcp SDK embedder paths where SSRF protection (SSRFProtection.validateUrlSync) fails to validate IPv4-mapped IPv6 addresses, enabling an attacker-controlled n8nApiUrl to cause the server to make HTTP requests to internal networks, cloud metadata endpoints, or lo...

CVE-2026-42259

Saltcorn is an extensible, open source, no-code database application builder. Prior to versions 1.4.6, 1.5.6, and 1.6.0-beta.5, Saltcorn validates the post-login dest parameter with a string check that only blocks :/ and //. Because all WHATWG-compliant browsers normalise backslashes \ to forward...

AZL-98700 CVE-2026-39823 affecting package golang 1.27.1-1

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS...