EUVD-2026-91590

Server-Side Request Forgery SSRF vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0...

CVE-2026-102797 WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0...

CVE-2026-102797

The ThemeREX Addons plugin for WordPress (versions

CVE-2026-104470

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services...

CVE-2026-104451

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId...

CVE-2026-104452

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104448

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

CVE-2026-104447

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

CVE-2026-104453

YesWiki versions prior to 4.6.7 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability within the admintag action. The root cause allows an attacker to delete tag associations by luring authenticated administrators into clicking crafted GET links. By supplying a wide ID range in the...

EUVD-2026-91464

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the deletetag parameter via top-level navigation, carrying the...

CVE-2026-104451

YesWiki versions prior to 4.6.7 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the RevisionsHandler component. The root cause is the lack of CSRF token validation for GET requests , which allows an attacker to trick users with write capabilities into navigating to a URL containing ...

CVE-2026-104452

Versions of YesWiki prior to 4.6.7 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability within the filemanager page handler . The root cause is the failure to validate a CSRF token on GET requests that perform file operations. An attacker could trick a logged-in administrator or p...

CVE-2026-104448

YesWiki versions prior to 4.6.7 are vulnerable to a cross-site request forgery (CSRF) vulnerability within the ajaxdeletepage handler. The root cause is the application's failure to validate a CSRF token on GET requests that include a jsonp_callback parameter. An attacker could entice a logged-in...

CVE-2026-80464

Server-Side request forgery SSRF vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-80464

A Server-Side request forgery (SSRF) vulnerability exists in the API Tool Runner of HAVELSAN Inc. Sef - AI Chatbot Platform . This issue allows an attacker to perform SSRF attacks. The vulnerability affects versions before 2.1 . Notably, the vendor has stated that this product is no longer suppor...

CVE-2026-80464 API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform

Server-Side request forgery SSRF vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-16001

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...

CVE-2026-16000

Missing cryptographic step in the DSTU 7624 CCM mode implementation KCcmBlockCipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid authentication tags, via messages encrypt...

EUVD-2026-91222

Improper verification of cryptographic signature in the attribute certificate path validator PkixAttrCertPathValidator, also used by PkixAttrCertPathBuilder in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to have a forged X.509 attribute certificate accepted as...

CVE-2026-16001 IesEngine stream-mode MAC forgery via length-dependent KDF split

Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine an IesEngine constructed without a block cipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed one encrypted message with known plainte...