CVE-2026-59101

MediumCVSS 5.8/10Last modified Oct 25, 2026

Description

AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jul 2, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-591025.4Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScri CVE-2026-591049.8UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the CVE-2026-591059.8Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived determinist CVE-2026-591069.8A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input CVE-2026-591079.8A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could CVE-2026-591098.8SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importi CVE-2026-59114.3Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a cr CVE-2026-591119.3Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura CVE-2026-591124.4Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Informat CVE-2026-591138.8Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-591159.9'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.CVE-2026-591166.8Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over