Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Version...

CVE-2026-29988

Milesight IoT devices (multiple models, affected firmware versions) are vulnerable to cleartext transmission of sensitive information through the NFC interface. An unauthenticated attacker with physical proximity can read LoRaWAN ABP NwkSKey , AppSKey , and D2D keys via a simple NFC read operatio...

SUSE CVE-2026-74270

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

PT-2026-81980

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all versions up to, and including, 2.3.7. This is due to flawed HMAC generation in the mbw get hash key function that uses the current user's identity instead of the cookie username...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

CVE-2025-56798

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

EUVD-2026-66748

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

PT-2026-82112

Name of the Vulnerable Software and Affected Versions @logtape/syslog versions prior to 1.3.11 @logtape/syslog versions prior to 2.0.14 @logtape/syslog versions prior to 2.1.5 Description Two output-encoding issues exist in the structured data formatting code when includeStructuredData is set to...

PT-2026-82235

Name of the Vulnerable Software and Affected Versions TP-Link Kasa affected versions not specified Description Multiple smart home devices have insufficient cryptographic protections in the local device communication protocol. An attacker on the same network can intercept, replay, or forge locall...

CVE-2026-75415

AntFlow V2.0.0 is vulnerable to Incorrect Access Control due to a flaw in the JiMuMDCCommonsRequestLoggingFilter.java component. The application improperly uses the userid from the request header as the primary mechanism for identity verification. This allows an attacker to forge user identity cr...

PT-2026-82258

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery SSRF vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2026-75332

Zyplayer-Doc versions 1.0.0 and earlier are vulnerable to Server-Side Request Forgery (SSRF) . This flaw exists in the WikiPageWebService.download() function, which can be leveraged by an attacker to induce the server to make requests to unintended locations. While no patched version is currently...

PT-2026-82307

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive...

CVE-2026-52776: Incomplete List of Disallowed Inputs

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirel...

Linux Distros Unpatched Vulnerability : CVE-2026-34964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for...

CVE-2026-75332

Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...

PT-2026-82336

Name of the Vulnerable Software and Affected Versions Zyplayer-Doc versions 1.0.0 and earlier Description An issue exists that allows Server-Side Request Forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. This occurs through the...