Threat Intelligence Database

CVE-2026-19752 is a server-side request forgery (SSRF) vulnerability in the EnzoVezzaro mcp-dominican-layer project affecting the parse-pdf function in src/index.ts. The vulnerability allows remote attackers to manipulate the pdfUrl argument to initiate SSRF attacks. The issue affects versions up to commit 39dd373786712650097ad31db27d5c477c8f9c82. The vulnerability has a medium severity with a CVSS score of 5.3. The project has been informed but has not yet responded or issued a fix. Exploit code has been publicly disclosed but there are no known exploits in the wild at this time.

CVE-2026-19751 is a server-side request forgery (SSRF) vulnerability in the EnzoVezzaro mcp-dominican-layer product. The flaw exists in the axios.get function call within the src/index.ts file of the parse-csv component, where manipulation of the csvUrl argument can lead to SSRF. The vulnerability can be exploited remotely, and proof-of-concept exploit code has been published. The product uses a rolling release strategy, so specific affected or fixed versions are not provided. The vendor has been informed but has not yet responded or issued a fix.