共收录 2014 条相关情报。
← 返回所有主题CVE-2026-101087
Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS web
CVE-2026-101064
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows p
CVE-2026-101087
Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS web
CVE-2026-101064
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows p
CVE-2026-101061
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incompl
CVE-2026-101060
python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_
CVE-2026-101059
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attacker
CVE-2026-101058
python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manu
CVE-2026-101061
utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incompl
CVE-2026-101060
python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_
CVE-2026-101059
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attacker
CVE-2026-101058
python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manu
CVE-2026-89003
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user
CVE-2026-89000
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destin
CVE-2026-100863
Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/serv
CVE-2026-100861
heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowin
CVE-2026-100858
heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nod
CVE-2026-100859
Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that all
CVE-2026-100848
AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syn
CVE-2026-100850
AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote pl