CVE-2026-87929

MaxSite CMS through version 109.6 contains a hardcoded session encryption key in application/config/config.php that is never rotated during installation. Because the key is publicly known, an unauthenticated attacker can compute an HMAC-SHA1 signature to mint a malicious ci_session cookie with ad...

CVE-2026-87929 MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-19233

CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint...

CVE-2026-86771 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

EUVD-2026-74948

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

CVE-2026-86771 Snipe-IT before 8.7.0 Server-Side Request Forgery via employee_num

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

WordPress Inquiry cart plugin <= 3.4.2 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Inquiry Cart versions = 3.4.2...

Exploit for CVE-2026-67276

RouterOS SSH Modulus-Confusion Validator CVE-2026-67276 An...

CVE-2026-78490

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

EUVD-2026-74850

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

CVE-2026-78490

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

CVE-2026-78490

Dell Secure Connect Gateway (SCG) 5.0 contains an Improper Restriction of Excessive Authentication Attempts vulnerability in both the Appliance (versions prior to 5.36.00.16) and Application (versions prior to 5.36.00.00) editions. An unauthenticated attacker with network access could exploit thi...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-87821

Lara Dashboard versions 0.9.2 through 1.3.1 are affected by a Server-Side Request Forgery (SSRF) in the POST /api/admin/builder/markdown/fetch endpoint. Any authenticated user can supply a malicious URL without host validation or redirect restrictions , allowing them to read the response body of ...

CVE-2026-79635

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery SSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...

CVE-2026-79635

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access can exploit it to gain unauthorized access . The vulnerability is rated CVSS 7.3 (High) with low impact on confidentiality, in...

CVE-2026-54048

Apache Impala versions 2.0.0 through 4.5.1 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists because specifying tblproperties('avro.schema.url'=' http://...') or a file:/// URI on a table allows an attacker to trigger a GET request to internal endpoints that the Impala serv...

CVE-2026-19733

Server-Side request forgery SSRF vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Server Side Request Forgery. This issue affects Library Information and Document Automati...

CVE-2026-19733

CVE-2026-19733 is a Server-Side Request Forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting's Library Information and Document Automation Program , affecting versions before v22.2 . The vulnerability allows an unauthenticated remote attacker to forge server-side requests, res...