CVE-2026-105706 SourceCodester Drug Recommendation System cross-site request forgery

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attac...

CVE-2026-105706

A cross-site request forgery (CSRF) vulnerability exists in the SourceCodester Drug Recommendation System 1.0 . The flaw is located in an unspecified function, allowing a remote attacker to perform unauthorized actions. The documents indicate that a proof-of-concept exploit is publicly available,...

EUVD-2026-92947

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attac...

CVE-2026-105706 SourceCodester Drug Recommendation System cross-site request forgery

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attac...

A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS.(CVE-2026-87664)

: A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication IPC storage callbacks, the service accepts and registers session structures including administrative ro...

PT-2026-106320

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attac...

PT-2026-107147

An unauthenticated attacker located on an adjacent private network or any attacker routed through a reverse proxy/load balancer that forwards client headers can forge their source IP address and gain administrative session privileges on the CV-CUE backend...

PT-2026-106774

Name of the Vulnerable Software and Affected Versions Crayons plugin for SPIP versions prior to 3.5.0 Description A missing authorization flaw allows unauthenticated attackers to modify arbitrary editable object fields. This occurs when the secu anti-forgery parameter is omitted in the 'crayons...

traefik -- Multiple vulnerabilities

The traefik project releases a new version addressing multiple vulnerabilities: GHSA-53qr-784g-cj35 FastProxy backend connection pool leaks identity GHSA-cw35-4q88-3rmp NTLM/Kerberos sticky round tripper is not keyed by service GHSA-fh26-gfpp-7xxx snicheck skips the check when req.TLS is nil...

PT-2026-106891

Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-105438

A Server-Side Request Forgery (SSRF) vulnerability exists in O2OA versions up to 10.0.1-ce . The flaw is located in the General Module within the function ActionUploadExcelWithUrl at the file path /x_general_assemble_control/jaxrs/excel/upload/with/url. An attacker can achieve SSRF by manipulatin...

CVE-2026-105438 O2OA General url ActionUploadExcelWithUrl server-side request forgery

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...

CVE-2026-105641

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-105641 Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-105641

The open-source project management tool Plane contains hardcoded credentials in its community deployment manifests prior to version 1.4.0 . Specifically, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known defaults for SECRET_KEY and LIVE_SERVER_S...

CVE-2026-105641 Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-105641 Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-105636

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...