CVE-2026-63642

SSRF in MagicMirror² Calendar Module A proof-of-concept exploit for CVE-2026-63642 and CVE-2026-63643, Server-Side Request Forgery vulnerabilities in MagicMirror²'s Calendar module that allow any unauthenticated attacker to force the server to make arbitrary HTTP requests to internal services...

EUVD-2026-76246

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

Exploit for CVE-2026-63642

SSRF in MagicMirror² Calendar Module A proof-of-concept explo...

CVE-2026-75583 keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...

CVE-2026-75583 keeper.sh Calendar version prior to 2.18.14 SSRF Guard Bypass via DNS Rebinding

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...

CVE-2026-75583: Server-Side Request Forgery (SSRF)

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...

PT-2026-78531

Name of the Vulnerable Software and Affected Versions keeper.sh calendar module versions prior to 2.18.14 Description An authenticated attacker can bypass the server-side request forgery SSRF guard to access private network addresses. This is achieved through a DNS rebinding attack targeting the...

NPM: MagicMirror: ssrf calendar .js

NPM: MagicMirror: ssrf calendar .js vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

CVE-2026-45121

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perfo...

CVE-2026-45122

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45120

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by getevents in inc/functionscalendar.php...

EUVD-2026-61017

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by getevents in inc/functionscalendar.php...

CVE-2026-45120

MyBB (free and open source forum software) versions prior to 1.8.40 contain an authorization flaw in the calendar module . The private-event check implemented in get_events() within inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions. This allows use...

CVE-2026-45120

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by getevents in inc/functionscalendar.php...

EUVD-2026-61010

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45122 MyBB: Insufficient permission check for calendar event move

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45122

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45122 MyBB: Insufficient permission check for calendar event move

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing...

CVE-2026-45122

In MyBB prior to 1.8.40, the do_move action in calendar.php skips checking canmoderateevents for the destination calendar, allowing a user with moderation rights on the source calendar to move events into a calendar where they only have view permission. This breaks intended access control boundar...

CVE-2026-45121

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perfo...