CWE-350
37 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 37Published CVEs36 of them scored
- 22Last 12 monthspublished in the last year
- 3Critical14 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-92704
SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution
sharpemu · sharpemu
High8.3 - CVE-2026-61546
AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools
ankimcp · anki-mcp-server-addon
High8.8 - CVE-2026-107292
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header
pydantic · pydantic-ai
Medium6.4 - CVE-2026-97875
DNS rebinding vulnerability in rojo serve HTTP API
rojo-rbx · rojo
High8.1 - CVE-2026-61743
Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation
chartbrew · chartbrew
Medium6.3 - CVE-2026-61568
@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport
zereight · gitlab-mcp
Critical9.6 - CVE-2026-53708
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
IBM · mcp-context-forge
Medium6.6 - CVE-2026-57123
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
MervinPraison · praisonaiagents
Critical9.8 - CVE-2026-55526
PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
MervinPraison · PraisonAI
High8.5 - CVE-2026-56709
Grav before 3.9.2 Host Header Injection via sendInvitationEmail
getgrav · grav
High8.7