CVE WatchJul 14, 2026

CVE-2026-15628

A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. This issue affects the function Vision._download_to_

CVSS

6.3

Medium

EPSS

0.2%

p12

KEV

—

Exploit Today

0-100

Published: Jul 14, 2026 · Last modified: Jul 14, 2026 · CWE-918

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-142026-07-17

Technical description

A security flaw has been discovered in zhayujie chatgpt-on-wechat CowAgent up to 2.1.1. This issue affects the function Vision._download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Performing a manipulation of the argument image results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.1.2 is capable of addressing this issue. The patch is named e85290cddcbb5ffc9c235927f4c92e5b4c3ec264. The affected component should be upgraded.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-202308.6 HIG

98.5%

KEV—80Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability17d CVE-2026-1540910.0 CRI

66.5%

KEV—70SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability2d CVE-2020-248819.8 CRI

99.4%

——30SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.8d CVE-2026-445788.6 HIG

98.4%

——30Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed in 15.5.16 and 16.2.5.2d CVE-2023-271597.5 HIG

98.3%

——29Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.10d CVE-2026-483327.7 HIG

95.7%

——29ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.3d