Lucene search
+L

94273 matches found

Cvelist
Cvelist
added 2026/08/04 6:00 a.m.49 views

CVE-2026-14816 The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

0.0025EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/04 6:00 a.m.13 views

EUVD-2026-52582

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers...

3.7CVSS5.5AI score0.00192EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/04 6:00 a.m.54 views

CVE-2026-10526

CVE-2026-10526 : The EmbedPress WordPress plugin (pre-4.6.1) does not validate user-supplied URLs before making server-side requests via unauthenticated endpoints, enabling a blind Server-Side Request Forgery (SSRF) that can force the site to issue HTTP requests to internal hosts and services not...

5.8CVSS5.3AI score0.00228EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/04 6:00 a.m.51 views

CVE-2026-14816

The GDPR Framework By Data443 WordPress plugin (before 2.4.0) does not properly verify authorization or data-subject identity when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary emails and flood the privacy-request ...

6.5CVSS5.6AI score0.0025EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/04 6:00 a.m.13 views

EUVD-2026-52580

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...

5.3CVSS5.5AI score0.00193EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/04 6:00 a.m.52 views

CVE-2026-16536

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 is affected by an unauthenticated Server-Side Request Forgery (SSRF) due to not validating a user-supplied URL before performing a server-side request (via the calendar_id flow). Root cause: absence of URL validation i...

5.3CVSS5.5AI score0.00193EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/04 6:00 a.m.44 views

CVE-2026-16536 Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...

0.00193EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/04 12:34 a.m.15 views

EUVD-2026-52516

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

10CVSS5.4AI score0.00478EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/04 12:17 a.m.11 views

CVE-2026-66325

Server-side request forgery ssrf in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

6.1CVSS0.00223EPSS
SaveExploits0References1
Amazon
Amazon
added 2026/08/04 12:00 a.m.8 views

Important: bind

Issue Overview: BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and...

8.6CVSS5.5AI score0.00523EPSS
SaveExploits0
Amazon
Amazon
added 2026/08/04 12:00 a.m.12 views

Important: runfinch-finch

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

7.8CVSS7.8AI score0.00447EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/08/03 10:57 p.m.8 views

CVE-2026-66325

Server-side request forgery ssrf in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

6.1CVSS5.5AI score0.00223EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/08/03 10:37 p.m.11 views

CVE-2026-48331

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

10CVSS5.4AI score0.00478EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/03 10:37 p.m.105 views

CVE-2026-48331

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to privilege escalation. The issue requires no user interaction and has a CRITICAL severity (CVSSv3.1: 10.0, Scope: CHANGED) with high impact on confidentiality, integrity, and availabil...

10CVSS5.4AI score0.00478EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/03 10:37 p.m.65 views

CVE-2026-48331 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

10CVSS0.00478EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/03 9:53 p.m.7 views

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

4.8CVSS5.5AI score
SaveExploits0References5
NVD
NVD
added 2026/08/03 9:16 p.m.11 views

CVE-2026-18736

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public...

5.3CVSS0.00243EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/03 9:16 p.m.13 views

CVE-2026-18647

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

7.5CVSS0.00354EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/08/03 8:45 p.m.9 views

CVE-2026-18647

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

7.5CVSS6.6AI score0.00354EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/03 8:45 p.m.11 views

EUVD-2026-52435

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

7.5CVSS6.6AI score0.00354EPSS
SaveExploits0References5
Rows per page
Query Builder