Dashboard / CVE-2026-19352

CVE-2026-19352

LOW
INFO Priority: 0.00 BB Relevance: 48/100
Published: 2026-08-09 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Adjacent
AC: High
PR: None
UI: None
S: X
AT: None
VC: Low
VI: None
VA: None

Description

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.

Weakness Classification (1)

References & Advisories (7)

Bug Bounty Relevance

48 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

1.3 / 10.0 v4.0
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.30%
Raw Score 0.002980
Percentile 22.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00298
2026-10-28
0.00298

Intelligence Sources

nvd ref →

External Links