https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T16:32:39.576983+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-112308 CVE-2026-112308 — crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool 2026-10-20T16:32:39.578605+00:00

Affected: crewAIInc crewai-tools

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials.