CVE-2026-19340

MediumCVSS 6.3/10Last modified Oct 23, 2026

Description

A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown function of the file backend-fix/complete_backend.js of the component Webhooks API. This manipulation of the argument url causes server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
anubissbeProjectHub-Mcp5.0

References

Timeline

Published
Aug 9, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-193418.8A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpCVE-2026-193427.3A vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown function of the file /index.php of the compCVE-2026-193437.3A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /aCVE-2026-193447.3A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the fileCVE-2026-193456.5A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. CVE-2026-193468.8A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListICVE-2026-193476.3A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdCVE-2026-193489.8A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is the function sprintf of the file /protocoCVE-2026-193499.8Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication CVE-2026-19354.3The Company Posts for LinkedIn plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.0. ThisCVE-2026-193506.3A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the comCVE-2026-193517.3A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery