CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

CVE-2026-12372

A Server-Side Request Forgery (SSRF) exists in nltk/nltk versions 3.9.4 and the current develop branch. The function nltk.pathsec.validate_network_url() fails to reject IPs in RFC 6598 shared address space (100.64.0.0/10) because Python’s ipaddress classification does not mark such addresses as i...

CVE-2026-19369

The CVE concerns KS-GEN-AI jira-mcp-server 0.2.0. It affects the add_attachment_from_public_url path in src/index.ts, specifically the function axios.get. Maliciously manipulating the imageUrl parameter enables server-side request forgery (SSRF) and requires a local attack. Exploit maturity is sh...

EUVD-2026-54953

A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component addattachmentfrompublicurl. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The proje...

CVE-2026-15534

creationtimestamp| type| source ---|---|--- 2026-08-09 18:53:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/f3q2gpg2kqmci 2026-08-10 03:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117068976931455651 2026-08-10 03:00:27+00:00| seen|...

BMC FootPrints 'feedUrl' - Server-Side Request Forgery

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling...

XWiki - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as:...

Starlette - Improper Validation of Unsafe Equivalence in Input

A flaw was found in Starlette, a lightweight ASGI Asynchronous Server Gateway Interface framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading...

WordPress StageShow <5.0.9 - Open Redirect

WordPress StageShow plugin before 5.0.9 contains an open redirect vulnerability in the Redirect function in stageshowredirect.php. A remote attacker can redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the url parameter. id: CVE-2015-5461 info: name:...

Telaen => v1.3.1 - Open Redirect

Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL. id: CVE-2013-2621 info: name: Telaen = v1.3.1 - Open Redirect author: ctflearner severity: medium description: | Open Redirection...

WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure

The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request id: CVE-2022-1595 info: name: WordPress HC Custom WP-Admin URL =1.5 to mitigate the vulnerability. reference: -...

UC Gateway Investment SiteEngine v5.0 - Open Redirect

Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action. id: CVE-2008-7269 info: name: UC Gateway Investment SiteEngine v5.0 - Open...

MooSocial 3.1.8 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability exisits in the dataredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. id: CVE-2023-43325 info: name: MooSocial 3.1.8 - Cross-Sit...

CVE-2026-19354

creationtimestamp| type| source ---|---|--- 2026-08-09 14:47:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/a4ovjan3ipnsr...

CVE-2026-15153

creationtimestamp| type| source ---|---|--- 2026-08-09 14:16:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msnrkhs5la26...

CVE-2026-19337

CVE-2026-19337 affects the package adenot mcp-google-search up to version 0.3.1. The vulnerability is in an unknown function within src/index.ts of the component read_webpage , enabling server-side request forgery (SSRF) through manipulation of the url argument. The attack is described as restric...

CVE-2026-71988

creationtimestamp| type| source ---|---|--- 2026-08-09 02:02:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msmihftfgd2y 2026-08-09 09:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msn7vxua2v2k...

CVE-2026-71944

creationtimestamp| type| source ---|---|--- 2026-08-08 18:53:34+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mslqloolu42n 2026-08-09 07:19:35+00:00| seen| https://bsky.app/profile/potato.software/post/3msn2bnw4s22i...

CVE-2026-71945

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...