Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:918"
686 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-7065 |
medium | 5.5 | 0.0029 | 2026-04-27 | A vulnerability has been found in BidingCC BuildingAI up to 26.0.1. Impacted is the function uploadR | |
CVE-2026-7094 |
medium | 5.5 | 0.0032 | 2026-04-27 | A vulnerability was determined in ShadowCloneLabs GlutamateMCPServers up to e2de73280b01e5d943593dd1 | |
CVE-2026-7146 |
medium | 5.5 | 0.0032 | 2026-04-27 | A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822 | |
CVE-2026-7147 |
medium | 5.5 | 0.0028 | 2026-04-27 | A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is so | |
CVE-2026-7158 |
medium | 5.5 | 0.0029 | 2026-04-27 | A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a | |
CVE-2026-7177 |
medium | 5.5 | 0.0036 | 2026-04-27 | A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1. Affected by this issue | |
CVE-2026-7417 |
medium | 5.5 | 0.0036 | 2026-04-29 | A vulnerability was found in Algovate xhs-mcp 0.8.11. This affects the function xhs_publish_content | |
CVE-2026-8725 |
medium | 5.5 | 0.0031 | 2026-05-17 | A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown f | |
CVE-2026-15330 |
medium | 5.5 | 0.0060 | 2026-07-10 | A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_ima | |
CVE-2026-16016 |
medium | 5.5 | 0.0050 | 2026-07-17 | A vulnerability was identified in poco-ai poco-claw up to 0.5.4. This issue affects the function run | |
CVE-2026-16084 |
medium | 5.5 | 0.0056 | 2026-07-18 | A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function web_fetch o | |
CVE-2026-16125 |
medium | 5.5 | 0.0050 | 2026-07-18 | A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_n | |
CVE-2026-16127 |
medium | 5.5 | 0.0050 | 2026-07-18 | A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get | |
CVE-2026-16128 |
medium | 5.5 | 0.0050 | 2026-07-18 | A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receive | |
CVE-2026-17534 |
medium | 5.5 | 0.0016 | 2026-07-27 | Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static host | |
CVE-2026-18647 |
medium | 5.5 | 0.0047 | 2026-08-03 | A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8f | |
CVE-2026-18973 |
medium | 5.5 | 0.0051 | 2026-08-06 | A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is | |
CVE-2026-19374 |
medium | 5.5 | 0.0050 | 2026-08-09 | A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593a | |
CVE-2026-116094 |
medium | 5.5 | 0.0036 | 2026-10-25 | A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_loca | |
CVE-2026-76347 |
medium | 5.4 | 0.0029 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway ve | |
CVE-2026-102923 |
medium | 5.4 | 0.0027 | 2026-10-16 | SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, | |
CVE-2026-117471 |
medium | 5.4 | 0.0024 | 2026-10-27 | Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring | |
CVE-2026-58278 |
medium | 5.4 | 0.0040 | 2026-07-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
CVE-2026-42641 |
medium | 5.4 | 0.0014 | 2026-04-29 | Server-Side Request Forgery (SSRF) vulnerability in ILLID Share This Image share-this-image allows S | |
CVE-2026-43879 |
medium | 5.4 | 0.0020 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated | |
CVE-2026-3341 |
medium | 5.4 | 0.0014 | 2026-06-11 | IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery ( | |
CVE-2026-53946 |
medium | 5.4 | 0.0021 | 2026-06-24 | Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Gho | |
CVE-2026-16027 |
medium | 5.4 | 0.0024 | 2026-08-07 | Server-Side request forgery (SSRF) vulnerability in Revenue Administration Türkiye's E-Signature all | |
CVE-2026-48483 |
medium | 5.4 | 0.0033 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding fea | |
CVE-2026-48762 |
medium | 5.4 | 0.0030 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action | |
CVE-2026-75053 |
medium | 5.4 | 0.0024 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint | |
CVE-2026-114620 |
medium | 5.4 | 0.0029 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's | |
CVE-2026-104331 |
medium | 5.4 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may | |
CVE-2026-97320 |
medium | 5.3 | 0.0026 | 2026-09-24 | A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is t | |
CVE-2026-114074 |
medium | 5.3 | 0.0036 | 2026-10-21 | Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authentic | |
CVE-2026-114076 |
medium | 5.3 | 0.0033 | 2026-10-21 | Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows auth | |
CVE-2026-114362 |
medium | 5.3 | 0.0024 | 2026-10-21 | A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file g | |
CVE-2026-114374 |
medium | 5.3 | 0.0024 | 2026-10-21 | A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown funct | |
CVE-2026-118577 |
medium | 5.3 | 0.0023 | 2026-10-28 | A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unkno | |
CVE-2026-33766 |
medium | 5.3 | 0.0024 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL() | |
CVE-2026-40100 |
medium | 5.3 | 0.0025 | 2026-04-10 | FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool end | |
CVE-2026-41055 |
medium | 5.3 | 0.0038 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in | |
CVE-2026-41654 |
medium | 5.3 | 0.0037 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with projec | |
CVE-2026-43995 |
medium | 5.3 | 0.0040 | 2026-05-11 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-48998 |
medium | 5.3 | 0.0020 | 2026-06-11 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 cont | |
CVE-2026-49345 |
medium | 5.3 | 0.0063 | 2026-06-19 | Mercator is an open source web application that enables mapping of the information system. Prior to | |
CVE-2026-54300 |
medium | 5.3 | 0.0031 | 2026-06-22 | @astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Ne | |
CVE-2026-50221 |
medium | 5.3 | 0.0022 | 2026-06-23 | In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-H | |
CVE-2026-54514 |
medium | 5.3 | 0.0037 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson | |
CVE-2026-55455 |
medium | 5.3 | 0.0039 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outb |