102890 matches found
CVE-2026-4912: Server-Side Request Forgery (SSRF)
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...
CVE-2026-43910: Unintended Proxy or Intermediary
Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...
PT-2026-65549
Name of the Vulnerable Software and Affected Versions terraform-mcp-server versions prior to 1.1.0 Description A server-side request forgery SSRF issue exists in the streamable-HTTP transport. This allows an unauthenticated remote client to redirect the server's Terraform API requests and the...
PT-2026-65440
In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...
PT-2026-65612
Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.9.1 through 0.60.1 Description An issue exists where the software silently dereferences HTTP or HTTPS URLs provided in JSON Schema $ref values without performing IP or host validation, scheme allow-listing, ...
PT-2026-65397
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the process bulk action function. This makes it possible for unauthenticate...
Fedora 43 : perl-Mojolicious (2026-6f12b08313)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6f12b08313 advisory. Mojolicious 9.48 fixes a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now masked with a fresh random value on every request...
PT-2026-65418
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...
PT-2026-65572
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the get urls from html function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validati...
librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload
A flaw was found in Libreswan's implementation of IKEv1 authentication via raw RSA signatures. When processing an IKEv1 packet using PKCS 1 v1.5 RSA encryption, the RSAauthenticatehashsignaturerawrsa function fails to properly validate the length of the authentication hash. A remote,...
librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload
A flaw was found in Libreswan's implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v15 scheme. The RSAauthenticatehashsignaturepkcs115rsa function does not correctly validate the DER encoding of the ASN.1 digest. A remote, unauthenticated attacker could...
CVE-2026-65442
Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...
CVE-2026-61953
Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...
Malicious code in @bonsai-ai/claude-code (npm)
Source: amazon-inspector ad3b5646cf88b8eb5a7dbbec9fc2f1cfefcdf3a241d9604992e72c2f629889b9 Package published as @bonsai-ai/claude-code impersonates Anthropic's official @anthropic-ai/claude-code CLI. package.json sets author to 'Anthropic ' and homepage to https://github.com/anthropics/claude-code...
CVE-2026-65442 WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...
CVE-2026-65442
Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...
CVE-2026-65442 WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...
CVE-2026-65442
CVE-2026-65442 is an unauthenticated Server-Side Request Forgery (SSRF) in the WordPress FormCraft plugin (versions ≤ 3.9.15). The root cause is missing nonce verification and authentication checks on the formcraft3_get AJAX endpoint, allowing an unauthenticated attacker to force the server to is...
CVE-2026-61953 WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...