CVE-2026-109189

MediumCVSS 6.3/10Last modified Oct 13, 2026

Description

A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. The affected element is the function Swagger3ParserApiDefinition.testUrlTimeout of the file backend/parser/api/dataimport/Swagger3ParserApiDefinition.java of the component Swagger3 Parser. Performing a manipulation of the argument swaggerUrl results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-109198.3Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potent CVE-2026-1091906.3A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsT CVE-2026-1091914.3The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Ex CVE-2026-1091937.2The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t CVE-2026-1091946.4A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested t CVE-2026-1091953.1A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauth CVE-2026-1091987.2The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user CVE-2026-1091998.8LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by s CVE-2026-10927.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 CVE-2026-109208.3Insufficient validation of untrusted input in WebShare in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had comp CVE-2026-1092006.4LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetch CVE-2026-1092018.3LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authen