CVE-2026-76795

HighCVSS 7.3/10Last modified Aug 25, 2026

Description

A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.0 will fix this issue. The identifier of the patch is 96448894cc93ccecb0bdcbf263a9d25390a8455e. Upgrading the affected component is advised.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2026
Last modified: Aug 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-767964.0The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate CVE-2026-767976.3The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading char CVE-2026-767986.3The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report with CVE-2026-767995.3A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/dat CVE-2026-76804.3A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/dat CVE-2026-768006.3A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post CVE-2026-768018.8The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code CVE-2026-768024.7Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply CVE-2026-768035.3Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not en CVE-2026-768045.5Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enf CVE-2026-768055.3Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go CVE-2026-76816.5A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this vulnerability is an unknown functionalit