Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-19352mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery

Description

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.

Show the exploits1

References tagged exploit1 reference

Timeline

  1. ID reserved

    By VulDB

  2. · 1 day later

    Published

  3. · 1 day later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-19352, by who scored it
Scored byCVSSScoreVector
VulDBCNA (assigner)4.0Low2.3CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)3.1Low3.1CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
VulDBCNA (assigner)3.0Low3.1CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
VulDBCNA (assigner)2.0Low1.8AV:A/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C
NVDNVD · Deferred4.0Low1.3CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.30% · top 77% of all CVEs (14 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.3.

Affected products

  • mifi · lossless-cut

    • affected 3.0
    • affected 3.1
    • affected 3.2
    • affected 3.3
    • affected 3.4
    • affected 3.5
    • affected 3.6
    • affected 3.7
    • affected 3.8
    • affected 3.9
    • affected 3.10
    • affected 3.11
    • affected 3.12
    • affected 3.13
    • affected 3.14
    • affected 3.15
    • affected 3.16
    • affected 3.17
    • affected 3.18
    • affected 3.19
    • affected 3.20
    • affected 3.21
    • affected 3.22
    • affected 3.23
    • affected 3.24
    • affected 3.25
    • affected 3.26
    • affected 3.27
    • affected 3.28
    • affected 3.29
    • affected 3.30
    • affected 3.31
    • affected 3.32
    • affected 3.33
    • affected 3.34
    • affected 3.35
    • affected 3.36
    • affected 3.37
    • affected 3.38
    • affected 3.39
    • and 30 more

References

References7

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-19352 badge
[![CVE-2026-19352](https://cveledger.app/badge/CVE-2026-19352.svg)](https://cveledger.app/cve/CVE-2026-19352)

Record last updated .