Low 3.1Published Aug 9, 2026

CVE-2026-19352mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery

Updated under an hour ago (2026-10-19 08:50 UTC)

Does this affect you?

It affects mifi lossless-cut. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for mifi lossless-cut

Exploited in the last 30 days

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the local network. This attack is characterized by high complexity. The exploitation is known to be difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 260802348955231442c4bae6c2d9d8ede947af0a. It is best practice to apply a patch to resolve this issue. The project maintainer provides this view: "I'm not sure that this is a critical vulnerability, because it is behind an experimental CLI flag and the NTLM behavior isn't really a LosslessCut bug." The CVSS vector reflects the high level of pre-requisites.

CVSS: 3.1 LOW (v3.1, CNA)CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Weakness (CWE): CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Aug 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

mifi lossless-cut mifi:lossless-cut	3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7; and 62 more ranges	CNA record

References

https://vuldb.com/vuln/387191vdb-entry
https://vuldb.com/vuln/387191/ctisignature, permissions-required
https://vuldb.com/cve/CVE-2026-19352third-party-advisory
https://vuldb.com/submit/865910third-party-advisory
https://my.feishu.cn/file/Jq4Ib90xeod3oPxlk77cv7jPnFeexploit
https://github.com/mifi/lossless-cut/commit/260802348955231442c4bae6c2d9d8ede947af0apatch
https://github.com/mifi/lossless-cut/product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.