CVE-2026-59101

MediumCVSS 5.8/10Last modified Jul 14, 2026

Description

AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jul 2, 2026
Last modified: Jul 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-591025.4Forgejo before 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScri CVE-2026-591098.8SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importi CVE-2026-59114.3Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a cr CVE-2026-591119.3Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura CVE-2026-591124.4Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Informat CVE-2026-591138.8Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-591159.9'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.CVE-2026-591166.8Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over CVE-2026-591177.5Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network.CVE-2026-591189.3Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.CVE-2026-591197.3Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.CVE-2026-59128.8Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a