agentprime: CWE-350

CVE-2026-92704: SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution

Wed, 04 Nov 2026 15:24:16 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-61546: AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools

Wed, 28 Oct 2026 21:40:16 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Thu, 08 Oct 2026 17:16:39 GMT

pydantic-ai >=1.34.0, <1.107.5 || >=2.0.0b1, <2.30.0, fixed in 1.107.5, 2.30.0. CVSS 6.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-61743: Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

Mon, 21 Sep 2026 21:38:47 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

Tue, 15 Sep 2026 20:54:55 GMT

@zereight/mcp-gitlab <2.1.30, fixed in 2.1.30. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

Tue, 25 Aug 2026 14:37:26 GMT

praisonaiagents <1.6.58, fixed in 1.6.58. CVSS 8.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-56709: Grav before 3.9.2 Host Header Injection via sendInvitationEmail

Tue, 25 Aug 2026 01:30:10 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-75514: BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot

Thu, 20 Aug 2026 18:31:51 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

Fri, 14 Aug 2026 19:49:14 GMT

mcp-contextforge-gateway <1.0.3, fixed in 1.0.3. CVSS 6.6 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

Thu, 30 Jul 2026 14:41:39 GMT

mcp <0.23.0, fixed in 0.23.0. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

Tue, 28 Jul 2026 21:45:48 GMT

datamodel-code-generator <0.63.0, fixed in 0.63.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-12635: Reliance on Reverse DNS Resolution for a Security-Critical Action in GitLab

Thu, 25 Jun 2026 04:33:34 GMT

CVSS 0.0 (None). Published by the CVE Program. Not analysed by agentprime yet.

Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack

Mon, 22 Jun 2026 21:31:44 GMT

glances <4.5.5, fixed in 4.5.5. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

Thu, 18 Jun 2026 13:55:54 GMT

praisonaiagents <1.6.59, fixed in 1.6.59. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-36604: Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks.

Wed, 03 Jun 2026 00:00:00 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Rojo development server vulnerable to DNS rebinding, allowing unauthenticated read/write access and local program execution

Tue, 02 Jun 2026 12:00:00 GMT

rojo >=0.0.0-0, <7.7.0, fixed in 7.7.0. CVSS 8.1 (High). Published by OSV. Not analysed by agentprime yet.

DNS rebinding vulnerability in rmcp Streamable HTTP server transport

Wed, 29 Apr 2026 12:00:00 GMT

rmcp >=0.0.0-0, <1.4.0, fixed in 1.4.0. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action

Thu, 23 Apr 2026 00:31:20 GMT

copilot-api <=0.7.0, no fixed version yet. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding

Fri, 17 Apr 2026 21:58:01 GMT

openclaw <2026.4.10, fixed in 2026.4.10. CVSS 4.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration

Fri, 03 Apr 2026 03:22:32 GMT

openclaw <2026.3.31, fixed in 2026.3.31. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation

Wed, 18 Mar 2026 18:31:16 GMT

org.jenkins-ci.main:jenkins-core >=2.442, <2.555, fixed in 2.555. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

Sat, 07 Mar 2026 09:30:15 GMT

org.apache.zookeeper:zookeeper >=3.8.0, <3.8.6 || >=3.9.0, <3.9.5, fixed in 3.8.6, 3.9.5. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-28271: Kiteworks Core is vulnerable to Server-Side Request Forgery (SSRF)

Fri, 27 Feb 2026 20:21:12 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-1490: Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.71 - Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation

Sun, 15 Feb 2026 02:22:56 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Tue, 02 Dec 2025 16:52:08 GMT

mcp <1.23.0, fixed in 1.23.0. CVSS 7.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Tue, 02 Dec 2025 16:51:57 GMT

@modelcontextprotocol/sdk <1.24.0, fixed in 1.24.0. CVSS 7.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-61430: Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server to return request payloads from other clients.

Fri, 24 Oct 2025 00:00:00 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Coder AgentAPI exposed user chat history via a DNS rebinding attack in github.com/coder/agentapi

Thu, 23 Oct 2025 16:25:09 GMT

github.com/coder/agentapi <0.4.0, fixed in 0.4.0. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vet MCP Server SSE Transport DNS Rebinding Vulnerability in github.com/safedep/vet

Thu, 23 Oct 2025 16:25:09 GMT

github.com/safedep/vet <1.12.5, fixed in 1.12.5. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-8036: DNS rebinding circumvents CORS

Tue, 22 Jul 2025 20:49:25 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Websites were able to send any requests to the development server and read the response in vite

Tue, 21 Jan 2025 19:52:55 GMT

vite <4.5.6 || >=5.0.0, <5.4.12 || >=6.0.0, <6.0.9, fixed in 4.5.6, 5.4.12, 6.0.9. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-53275: GHSL-2024-091: DNS rebinding attack in home-gallery

Mon, 23 Dec 2024 17:13:42 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

Thu, 05 Sep 2024 16:37:56 GMT

mindsdb <23.12.4.2, fixed in 23.12.4.2. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-42364: homepage DNS rebinding vulnerability (GHSL-2024-096)

Fri, 23 Aug 2024 15:44:27 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-22364: IBM Cognos Controller security bypass

Fri, 03 May 2024 18:14:34 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Ollama DNS rebinding vulnerability

Mon, 08 Apr 2024 21:31:16 GMT

github.com/ollama/ollama <0.1.29, fixed in 0.1.29. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-52235: SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Rebinding attack.

Fri, 05 Apr 2024 00:00:00 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Fri, 08 Sep 2023 12:19:49 GMT

com.github.tomakehurst:wiremock-jre8 <2.35.1, fixed in 2.35.1. CVSS 3.9 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-32020: Windows DNS Spoofing Vulnerability

Tue, 13 Jun 2023 23:26:19 GMT

CVSS 5.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

RubyGems vulnerable to DNS hijack attack

Sat, 14 May 2022 01:08:49 GMT

rubygems-update >=2.0.0, <2.0.16 || >=2.2.0, <2.2.4 || >=2.4.0, <2.4.7, fixed in 2.0.16, 2.2.4, 2.4.7. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

RubyGems has Origin Validation Error vulnerability

Fri, 13 May 2022 01:38:25 GMT

rubygems-update <2.6.13, fixed in 2.6.13. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding

Fri, 13 May 2022 01:08:23 GMT

node-inspector >=6.0, no fixed version yet. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

DNS Rebinding in etcd

Tue, 15 Feb 2022 01:57:18 GMT

go.etcd.io/etcd <3.4.0, fixed in 3.4.0. CVSS 5.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2021-34561: A vulnerability in WirelessHART-Gateway <= 3.0.8 allows to bypass any IP or firewall based access restrictions through DNS rebinding

Tue, 31 Aug 2021 10:32:56 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Weave Net clusters susceptible to MitM attacks via IPv6 rogue router advertisements

Thu, 27 May 2021 19:00:08 GMT

github.com/weaveworks/weave <2.6.3, fixed in 2.6.3. CVSS 5.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2021-22884: Node: Node.js before 10.24.0, 12.21.0, 14.16.0…

Wed, 03 Mar 2021 17:37:46 GMT

Published by the CVE Program. Not analysed by agentprime yet.