Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Advisory: agentfront mcp-from-openapi — GitHub Security Advisory (GHSA-ff5q-5r4v-fw4v) Clear all filters
TI-2026-79752 CVE-2026-115751 · GHSA-wfcf-h98w-gp9m

Incomplete denylist in Agentfront mcp-from-openapi allows SSRF via trailing dot

Priority MEDIUM 61

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0025 Published 2026-10-23 Fixed in 2.9.0 CWE-184
TI-2026-79751 CVE-2026-115750 · GHSA-3gr3-m4x5-3fpp

Credential leak via cross-origin redirects in mcp-from-openapi

Priority MEDIUM 61

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00221 Published 2026-10-23 Fixed in 2.9.0 CWE-522