CVE-2026-19770Disclosure

LOWCVSS 1.9 · LOW

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 3 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets4 URLs

By indicator

Full discourse3 posts

Infoflowcloud@infoflowcloud46d
Disclosure
🚨*CVE* CVE-2026-19770 A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/ind… https://www.cve.org/CVERecord?id=CVE-2026-19770 ----- Traducción: CVE-2026-19770 Se … https://infoflow.cloud`
Post summary
The text announces CVE‑2026‑19770 in feedmob fm‑mcp‑servers 0.0.3, noting the affected downloadReport function, but provides no additional technical details, PoC, or exploitation information.
0000042
98 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-19770 A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/ind… https://www.cve.org/CVERecord?id=CVE-2026-19770
Post summary
The post announces CVE-2026-19770 for feedmob fm-mcp-servers 0.0.3, identifying the affected function but providing no further technical or mitigation details.
000001.3K
57.9K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds46d
Disclosure
CVE-2026-19770 SSRF in feedmob fm-mcp-servers 0.0.3 Download Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-19770 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces an SSRF vulnerability in feedmob fm‑mcp‑servers 0.0.3, linking to a details page but providing no PoC, patch, or active exploitation evidence.
00000107
4.1K followersView on X

Explore more

Back to dashboard