https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T20:37:48.590066+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-348649 EUVD-2026-348649 2026-10-19T20:37:48.636375+00:00 EUVD-2026-348649 https://cve.radiocsirt.org/vuln/fkie_cve-2025-5276 fkie_cve-2025-5276 2026-10-19T20:37:48.636411+00:00

Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function. An attacker can craft a prompt that, once accessed by the MCP host, can invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to issue requests and read the responses to attacker-controlled URLs, potentially leaking sensitive information.

 https://cve.radiocsirt.org/vuln/ghsa-frq9-3hp2-xvxg GHSA-frq9-3hp2-xvxg — Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function 2026-10-19T20:37:48.636445+00:00

Affected: npm: mcp-markdownify-server

All versions of the package mcp-markdownify-server are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function. An attacker can craft a prompt that, once accessed by the MCP host, can invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to issue requests and read the responses to attacker-controlled URLs, potentially leaking sensitive information.