CWE-350

CVEs per yearBy the year they were published

1. 20171
2. 20181
3. 20201
4. 20212
5. 20242
6. 20242
7. 20241
8. 20255
9. 202621

Newest CVEs

• CVE-2026-61546

  AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools

  ankimcp · anki-mcp-server-addon

  High8.8
• CVE-2026-107292

  Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

  pydantic · pydantic-ai

  Medium6.4
• CVE-2026-97875

  DNS rebinding vulnerability in rojo serve HTTP API

  rojo-rbx · rojo

  High8.1
• CVE-2026-61743

  Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

  chartbrew · chartbrew

  Medium6.3
• CVE-2026-61568

  @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

  zereight · gitlab-mcp

  Critical9.6
• CVE-2026-53708

  ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)

  IBM · mcp-context-forge

  Medium6.6
• CVE-2026-57123

  PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in

  MervinPraison · praisonaiagents

  Critical9.8
• CVE-2026-55526

  PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)

  MervinPraison · PraisonAI

  High8.5
• CVE-2026-56709

  Grav before 3.9.2 Host Header Injection via sendInvitationEmail

  getgrav · grav

  High8.7
• CVE-2026-75514

  BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot

  bunkerity · bunkerweb

  Medium5.9

Vendors it comes up for most

1. IBM2
2. MervinPraison2
3. modelcontextprotocol2
4. Apache Software Foundation1
5. GitLab1
6. HackerOne1
7. Jenkins Project1
8. Microsoft1
9. Mozilla1
10. NodeJS1