101749 matches found
CVE-2026-103067
The Memberful - Membership Plugin for WordPress is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in the memberful-wp component. This issue impacts versions up to and including 1.81.0 . The vulnerability allows for unauthorized actions to be performed on behalf of a user. Details...
CVE-2026-103291
Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...
CVE-2026-103285
Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when...
CVE-2026-103254
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...
CVE-2026-103082
Server-Side Request Forgery SSRF vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2...
EUVD-2026-90684
Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...
CVE-2026-103287 Ghost 1.18.0 before 6.27.0 Server-Side Request Forgery via Webhook
Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...
CVE-2026-103285
Ghost versions from 5.19.0 before 6.57.1 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within the post feedback functionality . This flaw allows an attacker to craft a malicious link that, when visited by an authenticated member, automatically submits feedback on their behal...
CVE-2026-103285 Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery
Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when...
EUVD-2026-90678
Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when...
CVE-2026-103285 Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery
Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit feedback on behalf of logged-in users. Attackers can craft a malicious link to the feedback page that automatically submits feedback when...
CVE-2026-103254 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...
CVE-2026-103254
The software n8n is vulnerable to a path traversal vulnerability in its signed resume URL generation for Send-and-Wait approvals . Affected versions include those before 1.123.80 , 2.0.0 before 2.39.6 , and 2.40.0 before 2.40.1 . An attacker with workflow creation permissions can exploit unresolv...
CVE-2026-103254 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...
EUVD-2026-90648
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...
CVE-2026-103254 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...
EUVD-2026-90747
Server-Side Request Forgery SSRF vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request Forgery.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2...
CLEANSTART-2024-SC89971 Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities
Security vulnerability affects the drupal7 package. Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...
CVE-2026-103542
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...
WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Payment Confirmation Forgery vulnerability
Unauthenticated Payment Confirmation Forgery vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Payments for Hubtel versions 1.0.2...