CVE-2026-104447

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

CVE-2026-104453

YesWiki versions prior to 4.6.7 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability within the admintag action. The root cause allows an attacker to delete tag associations by luring authenticated administrators into clicking crafted GET links. By supplying a wide ID range in the...

EUVD-2026-91464

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the deletetag parameter via top-level navigation, carrying the...

CVE-2026-104451

YesWiki versions prior to 4.6.7 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the RevisionsHandler component. The root cause is the lack of CSRF token validation for GET requests , which allows an attacker to trick users with write capabilities into navigating to a URL containing ...

CVE-2026-104452

Versions of YesWiki prior to 4.6.7 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability within the filemanager page handler . The root cause is the failure to validate a CSRF token on GET requests that perform file operations. An attacker could trick a logged-in administrator or p...

CVE-2026-104448

YesWiki versions prior to 4.6.7 are vulnerable to a cross-site request forgery (CSRF) vulnerability within the ajaxdeletepage handler. The root cause is the application's failure to validate a CSRF token on GET requests that include a jsonp_callback parameter. An attacker could entice a logged-in...

CVE-2026-80464

Server-Side request forgery SSRF vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-80464

A Server-Side request forgery (SSRF) vulnerability exists in the API Tool Runner of HAVELSAN Inc. Sef - AI Chatbot Platform . This issue allows an attacker to perform SSRF attacks. The vulnerability affects versions before 2.1 . Notably, the vendor has stated that this product is no longer suppor...

CVE-2026-80464 API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform

Server-Side request forgery SSRF vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-16000

Missing cryptographic step in the DSTU 7624 CCM mode implementation KCcmBlockCipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags, via messages encrypt...

CVE-2026-16001

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

EUVD-2026-91222

Improper verification of cryptographic signature in the attribute certificate path validator PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as...

CVE-2026-16001 IesEngine stream-mode MAC forgery via length-dependent KDF split

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

CVE-2026-16001 IesEngine stream-mode MAC forgery via length-dependent KDF split

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

CVE-2026-16001 IesEngine stream-mode MAC forgery via length-dependent KDF split

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

CVE-2026-16000 KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used

Missing cryptographic step in the DSTU 7624 CCM mode implementation KCcmBlockCipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags, via messages encrypt...

CVE-2026-16000 KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used

Missing cryptographic step in the DSTU 7624 CCM mode implementation KCcmBlockCipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags, via messages encrypt...

CVE-2026-16000 KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used

Missing cryptographic step in the DSTU 7624 CCM mode implementation KCcmBlockCipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags, via messages encrypt...

CVE-2026-16000

The bc-csharp library (before version 2.7.0 ) by Legion of the Bouncy Castle Inc. contains a missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher ). The vulnerability occurs because the G1 block , which is responsible for binding the nonce , message length, and par...

CVE-2026-104120

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...