Answer in brief
CVE-2026-19984 records a Unknown severity vulnerability in jkawamoto mcp-florence2 __init__.py get_images server-side request forgery. The current sources do not mark it as known exploited. The current feed maps jkawamoto/mcp-florence2 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps jkawamoto/mcp-florence2 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| jkawamoto/mcp-florence2generic | 0.3.0 || 0.3.1 || 0.3.2 || 0.3.3 || 0.3.4 || 0.3.5 || 0.3.6 || 0.3.7 || 0.3.8 || 0.3.9 || 0.3.10 || 0.3.11 || 0.3.12 || 0.3.13 | Not reported |
Published upstream
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 17, 2026
A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florence2/__init__.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. It is recommended to change the configuration settings. The vendor explains: "For deployments where SSRF protection is required, I recommend routing all HTTP(S) requests through an SSRF-safe proxy server. This approach mitigates the vulnerability without requiring changes to the mcp-florence2 source code."
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-19984 records a Unknown severity vulnerability in jkawamoto mcp-florence2 __init__.py get_images server-side request forgery. The current sources do not mark it as known exploited. The current feed maps jkawamoto/mcp-florence2 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps jkawamoto/mcp-florence2 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| jkawamoto/mcp-florence2generic | 0.3.0 || 0.3.1 || 0.3.2 || 0.3.3 || 0.3.4 || 0.3.5 || 0.3.6 || 0.3.7 || 0.3.8 || 0.3.9 || 0.3.10 || 0.3.11 || 0.3.12 || 0.3.13 | Not reported |
Published upstream
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 17, 2026
A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florence2/__init__.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. It is recommended to change the configuration settings. The vendor explains: "For deployments where SSRF protection is required, I recommend routing all HTTP(S) requests through an SSRF-safe proxy server. This approach mitigates the vulnerability without requiring changes to the mcp-florence2 source code."
Quoted source text, attributed separately from HOL analysis.