Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-108523 (GCVE-0-2026-108523)

Vulnerability from nvd – Published: 2026-10-11 04:15 – Updated: 2026-10-11 04:15 Disputed X_Open Source

Title

Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery

Summary

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: "Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification."

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3682 records in the last 180 days details

References

8 references

URL	Tags
https://vuldb.com/vuln/416189	vdb-entrytechnical-description
https://vuldb.com/vuln/416189/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108523	third-party-advisory
https://vuldb.com/submit/893367	third-party-advisory
https://gist.github.com/jovair1994/93446c14d30a16…	exploit
https://github.com/Studio-Saelix/sencho/pull/1877	issue-trackingpatch
https://github.com/Studio-Saelix/sencho/commit/79…	patch
https://github.com/Studio-Saelix/sencho/	product

Impacted products

1 product

Vendor	Product	Version
Studio-Saelix	Sencho	Affected: 0.94.0 Affected: 0.94.1 cpe:2.3:a:studio-saelix:sencho::::::::

Credits

jpazz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:studio-saelix:sencho:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "git-sources Browse API Endpoint"
          ],
          "product": "Sencho",
          "vendor": "Studio-Saelix",
          "versions": [
            {
              "status": "affected",
              "version": "0.94.0"
            },
            {
              "status": "affected",
              "version": "0.94.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "jpazz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: \"Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T04:15:16.042Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416189 | Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416189"
        },
        {
          "name": "VDB-416189 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416189/cti"
        },
        {
          "name": "CVE-2026-108523 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108523"
        },
        {
          "name": "Submit #893367 | Studio-Saelix sencho \u003c= 0.94.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893367"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/jovair1994/93446c14d30a16313e830490d71bbd1d"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/pull/1877"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/"
        }
      ],
      "tags": [
        "disputed",
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-10T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-10T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-10T14:53:58.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108523",
    "datePublished": "2026-10-11T04:15:16.042Z",
    "dateReserved": "2026-10-10T12:48:42.678Z",
    "dateUpdated": "2026-10-11T04:15:16.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108522 (GCVE-0-2026-108522)

Vulnerability from nvd – Published: 2026-10-11 04:00 – Updated: 2026-10-11 04:00 X_Open Source

Title

Studio-Saelix Sencho Login Endpoint login improper authentication

Summary

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: "The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity."

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

8.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

CWE

CWE-287 - Improper Authentication

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3682 records in the last 180 days details

References

8 references

URL	Tags
https://vuldb.com/vuln/416188	vdb-entrytechnical-description
https://vuldb.com/vuln/416188/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108522	third-party-advisory
https://vuldb.com/submit/893366	third-party-advisory
https://gist.github.com/jovair1994/839c8aaca1f375…	exploit
https://github.com/Studio-Saelix/sencho/pull/1877	issue-trackingpatch
https://github.com/Studio-Saelix/sencho/commit/79…	patch
https://github.com/Studio-Saelix/sencho/	product

Impacted products

1 product

Vendor	Product	Version
Studio-Saelix	Sencho	Affected: 0.94.0 Affected: 0.94.1 cpe:2.3:a:studio-saelix:sencho::::::::

Credits

jpazz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:studio-saelix:sencho:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Login Endpoint"
          ],
          "product": "Sencho",
          "vendor": "Studio-Saelix",
          "versions": [
            {
              "status": "affected",
              "version": "0.94.0"
            },
            {
              "status": "affected",
              "version": "0.94.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "jpazz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: \"The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T04:00:17.265Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416188 | Studio-Saelix Sencho Login Endpoint login improper authentication",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416188"
        },
        {
          "name": "VDB-416188 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416188/cti"
        },
        {
          "name": "CVE-2026-108522 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108522"
        },
        {
          "name": "Submit #893366 | Studio-Saelix sencho \u003c= 0.94.1 Authentication Bypass by Spoofing",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893366"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/jovair1994/839c8aaca1f37567cdd02e107a389f6a"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/pull/1877"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-10T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-10T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-10T14:53:54.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Studio-Saelix Sencho Login Endpoint login improper authentication",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108522",
    "datePublished": "2026-10-11T04:00:17.265Z",
    "dateReserved": "2026-10-10T12:48:39.264Z",
    "dateUpdated": "2026-10-11T04:00:17.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108521 (GCVE-0-2026-108521)

Vulnerability from nvd – Published: 2026-10-11 02:45 – Updated: 2026-10-11 02:45

Title

Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

Summary

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration."

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

4.7 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3682 records in the last 180 days details

References

5 references

URL	Tags
https://vuldb.com/vuln/416187	vdb-entrytechnical-description
https://vuldb.com/vuln/416187/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108521	third-party-advisory
https://vuldb.com/submit/893356	third-party-advisory
https://gist.github.com/jovair1994/db23594d74428d…	exploit

Impacted products

1 product

Vendor	Product	Version
Studio-Saelix	Sencho	Affected: 0.97.0 Affected: 0.97.1 cpe:2.3:a:studio-saelix:sencho::::::::

Credits

jpazz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:studio-saelix:sencho:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Add Remote Node API Endpoint"
          ],
          "product": "Sencho",
          "vendor": "Studio-Saelix",
          "versions": [
            {
              "status": "affected",
              "version": "0.97.0"
            },
            {
              "status": "affected",
              "version": "0.97.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "jpazz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: \"The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T02:45:12.112Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416187 | Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416187"
        },
        {
          "name": "VDB-416187 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416187/cti"
        },
        {
          "name": "CVE-2026-108521 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108521"
        },
        {
          "name": "Submit #893356 | Studio-Saelix sencho \u003c= 0.94.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893356"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/jovair1994/db23594d74428d38606e8000beb867d4"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-10T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-10T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-10T14:53:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108521",
    "datePublished": "2026-10-11T02:45:12.112Z",
    "dateReserved": "2026-10-10T12:48:35.614Z",
    "dateUpdated": "2026-10-11T02:45:12.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108523 (GCVE-0-2026-108523)

Vulnerability from cvelistv5 – Published: 2026-10-11 04:15 – Updated: 2026-10-11 04:15 Disputed X_Open Source

Title

Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery

Summary

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: "Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification."

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3682 records in the last 180 days details

References

8 references

URL	Tags
https://vuldb.com/vuln/416189	vdb-entrytechnical-description
https://vuldb.com/vuln/416189/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108523	third-party-advisory
https://vuldb.com/submit/893367	third-party-advisory
https://gist.github.com/jovair1994/93446c14d30a16…	exploit
https://github.com/Studio-Saelix/sencho/pull/1877	issue-trackingpatch
https://github.com/Studio-Saelix/sencho/commit/79…	patch
https://github.com/Studio-Saelix/sencho/	product

Impacted products

1 product

Vendor	Product	Version
Studio-Saelix	Sencho	Affected: 0.94.0 Affected: 0.94.1 cpe:2.3:a:studio-saelix:sencho::::::::

Credits

jpazz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:studio-saelix:sencho:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "git-sources Browse API Endpoint"
          ],
          "product": "Sencho",
          "vendor": "Studio-Saelix",
          "versions": [
            {
              "status": "affected",
              "version": "0.94.0"
            },
            {
              "status": "affected",
              "version": "0.94.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "jpazz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: \"Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T04:15:16.042Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416189 | Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416189"
        },
        {
          "name": "VDB-416189 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416189/cti"
        },
        {
          "name": "CVE-2026-108523 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108523"
        },
        {
          "name": "Submit #893367 | Studio-Saelix sencho \u003c= 0.94.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893367"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/jovair1994/93446c14d30a16313e830490d71bbd1d"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/pull/1877"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/"
        }
      ],
      "tags": [
        "disputed",
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-10T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-10T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-10T14:53:58.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108523",
    "datePublished": "2026-10-11T04:15:16.042Z",
    "dateReserved": "2026-10-10T12:48:42.678Z",
    "dateUpdated": "2026-10-11T04:15:16.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108522 (GCVE-0-2026-108522)

Vulnerability from cvelistv5 – Published: 2026-10-11 04:00 – Updated: 2026-10-11 04:00 X_Open Source

Title

Studio-Saelix Sencho Login Endpoint login improper authentication

Summary

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: "The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity."

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

8.3 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C

CWE

CWE-287 - Improper Authentication

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3682 records in the last 180 days details

References

8 references

URL	Tags
https://vuldb.com/vuln/416188	vdb-entrytechnical-description
https://vuldb.com/vuln/416188/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108522	third-party-advisory
https://vuldb.com/submit/893366	third-party-advisory
https://gist.github.com/jovair1994/839c8aaca1f375…	exploit
https://github.com/Studio-Saelix/sencho/pull/1877	issue-trackingpatch
https://github.com/Studio-Saelix/sencho/commit/79…	patch
https://github.com/Studio-Saelix/sencho/	product

Impacted products

1 product

Vendor	Product	Version
Studio-Saelix	Sencho	Affected: 0.94.0 Affected: 0.94.1 cpe:2.3:a:studio-saelix:sencho::::::::

Credits

jpazz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:studio-saelix:sencho:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Login Endpoint"
          ],
          "product": "Sencho",
          "vendor": "Studio-Saelix",
          "versions": [
            {
              "status": "affected",
              "version": "0.94.0"
            },
            {
              "status": "affected",
              "version": "0.94.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "jpazz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named 79b86ddcd4aefdd6941f098e35990ab397b13c72. To fix this issue, it is recommended to deploy a patch. The vendor confirms: \"The login limiter relied on client-supplied X-Forwarded-For data without an explicit trusted-proxy boundary, allowing an attacker to rotate the apparent client address. The remediation now ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by normalized account identity.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T04:00:17.265Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416188 | Studio-Saelix Sencho Login Endpoint login improper authentication",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416188"
        },
        {
          "name": "VDB-416188 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416188/cti"
        },
        {
          "name": "CVE-2026-108522 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108522"
        },
        {
          "name": "Submit #893366 | Studio-Saelix sencho \u003c= 0.94.1 Authentication Bypass by Spoofing",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893366"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/jovair1994/839c8aaca1f37567cdd02e107a389f6a"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/pull/1877"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/Studio-Saelix/sencho/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-10T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-10T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-10T14:53:54.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Studio-Saelix Sencho Login Endpoint login improper authentication",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108522",
    "datePublished": "2026-10-11T04:00:17.265Z",
    "dateReserved": "2026-10-10T12:48:39.264Z",
    "dateUpdated": "2026-10-11T04:00:17.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108521 (GCVE-0-2026-108521)

Vulnerability from cvelistv5 – Published: 2026-10-11 02:45 – Updated: 2026-10-11 02:45

Title

Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

Summary

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration."

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

4.7 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

CWE

CWE-918 - Server-Side Request Forgery

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3682 records in the last 180 days details

References

5 references

URL	Tags
https://vuldb.com/vuln/416187	vdb-entrytechnical-description
https://vuldb.com/vuln/416187/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108521	third-party-advisory
https://vuldb.com/submit/893356	third-party-advisory
https://gist.github.com/jovair1994/db23594d74428d…	exploit

Impacted products

1 product

Vendor	Product	Version
Studio-Saelix	Sencho	Affected: 0.97.0 Affected: 0.97.1 cpe:2.3:a:studio-saelix:sencho::::::::

Credits

jpazz (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:studio-saelix:sencho:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Add Remote Node API Endpoint"
          ],
          "product": "Sencho",
          "vendor": "Studio-Saelix",
          "versions": [
            {
              "status": "affected",
              "version": "0.97.0"
            },
            {
              "status": "affected",
              "version": "0.97.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "jpazz (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: \"The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T02:45:12.112Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416187 | Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416187"
        },
        {
          "name": "VDB-416187 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416187/cti"
        },
        {
          "name": "CVE-2026-108521 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108521"
        },
        {
          "name": "Submit #893356 | Studio-Saelix sencho \u003c= 0.94.1 Server-Side Request Forgery",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/893356"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/jovair1994/db23594d74428d38606e8000beb867d4"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-10T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-10T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-10T14:53:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108521",
    "datePublished": "2026-10-11T02:45:12.112Z",
    "dateReserved": "2026-10-10T12:48:35.614Z",
    "dateUpdated": "2026-10-11T02:45:12.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

6 vulnerabilities by Studio-Saelix

CVE-2026-108523 (GCVE-0-2026-108523)

CVE-2026-108522 (GCVE-0-2026-108522)

CVE-2026-108521 (GCVE-0-2026-108521)

CVE-2026-108523 (GCVE-0-2026-108523)

CVE-2026-108522 (GCVE-0-2026-108522)

CVE-2026-108521 (GCVE-0-2026-108521)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

6 vulnerabilities by Studio-Saelix

CVE-2026-108523 (GCVE-0-2026-108523)

CVE-2026-108522 (GCVE-0-2026-108522)

CVE-2026-108521 (GCVE-0-2026-108521)

CVE-2026-108523 (GCVE-0-2026-108523)

CVE-2026-108522 (GCVE-0-2026-108522)

CVE-2026-108521 (GCVE-0-2026-108521)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.