Threat database

CVE-2026-108787 is a server-side request forgery (SSRF) vulnerability in houtini-ai voice-analyser-mcp versions 2.1.0 and 2.1.1. The flaw exists in the fetch function of src/utils/crawler.ts within the collect_corpus component, where manipulation of the sitemap_url argument allows SSRF. Remote exploitation is possible, and a public exploit is available. The vendor has not responded to disclosure attempts. The CVSS 4.0 score is 5.3, indicating medium severity.

CVE-2026-108786 is a server-side request forgery (SSRF) vulnerability in the houtini-ai seo-crawler-mcp product, specifically in the run_seo_audit function of src/core/CrawlOrchestrator.ts. It affects versions 2.1.0 through 2.1.5. The vulnerability allows remote attackers to manipulate server requests, potentially causing unauthorized requests to internal or external systems. The vendor has not responded to the disclosure, and no patch or fix is currently available. The CVSS 4.0 score rates this as a medium severity issue.

CVE-2026-82112 is a medium severity path traversal vulnerability found in houtini-ai's houtini-lm product up to version 2.13.2. The flaw exists in an unspecified function within the src/index.ts file of the code_task_files component. This vulnerability can be exploited remotely and may allow an attacker to manipulate file paths. A patch identified by commit 35d97bca0531894da36a85aedb95312da1bd5b7a has been created to address this issue. Users are advised to apply this patch to mitigate the risk.