CVE-2026-7146

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Apr 27, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-714604.3/api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, skCVE-2026-714614.3HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers CVE-2026-714624.1StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 respCVE-2026-714632.7Notification template Jinja AST whitelist only inspects static Getattr nodes. Dynamic subscripts (job['job'+'_env']) CVE-2026-714643.1LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobCVE-2026-714653.1RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(CVE-2026-714677.5A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a requeCVE-2026-714685.3A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearCVE-2026-714697.5A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each uCVE-2026-71477.3A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file serCVE-2026-714709.1A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to maniCVE-2026-714719.0A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to th