CVE-2026-10274

A vulnerability was determined in indrasishbanerjee aem-mcp-server up to b5f833aef9b5dfd17a5991b3b18a8a11edbdc583. This impacts the function getAssetMetadata of the file src/mcp-server.ts of the component Axios Request Flow. Executing a manipulation of the argument assetPath can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-918

• https://github.com/indrasishbanerjee/aem-mcp-server/
• https://github.com/indrasishbanerjee/aem-mcp-server/issues/3
• https://vuldb.com/cve/CVE-2026-10274
• https://vuldb.com/submit/825401
• https://vuldb.com/vuln/367553
• https://vuldb.com/vuln/367553/cti

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102729`gx_binres_theme_load()` sizes its theme buffer for the them…5.9
• CVE-2026-10273A vulnerability was found in php-censor up to 2.1.6. This af…7.3
• CVE-2026-102730Mounting an attacker-controlled NAND flash image (`lx_nand_f…8.6
• CVE-2026-102731Memory allocation with excessive size value vulnerability in…7.5
• CVE-2026-102734asteval is a Python expression evaluator designed for restri…5.5
• CVE-2026-102739ESPectre is a Wi-Fi motion sensing platform for ESP32. Prior…7.8
• CVE-2026-102740The AsyncHttpClient library allows Java applications to exec…5.8
• CVE-2026-102748Dgraph is an open source distributed GraphQL database. Prior…9.2
• CVE-2026-10275A flaw has been found in OpenSC up to 0.26.1. This affects t…5
• CVE-2026-102755DataEase is an open source data visualization and analysis t…5.1
• CVE-2026-102756DataEase is an open source data visualization and analysis t…5.1
• CVE-2026-102757An unprivileged, memory-protected ThreadX module can have th…8.5