CVE-2026-65488

Cross-Site Request Forgery CSRF vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2...

CVE-2026-65471

Unauthenticated Cross Site Request Forgery CSRF in Avada Core = 5.15.6 versions...

CVE-2026-65466

Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...

CVE-2026-65467

Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...

CVE-2026-65460

Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...

CVE-2026-65464

Unauthenticated Cross Site Request Forgery CSRF in GiveWP = 4.16.3 versions...

CVE-2026-57784

Unauthenticated Cross Site Request Forgery CSRF in Ninja Forms File Uploads Extension = 3.3.26 versions...

CVE-2026-57785

Unauthenticated Cross Site Request Forgery CSRF in ApusListing = 1.2.63 versions...

CVE-2026-57626

Cross-Site Request Forgery CSRF vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0...

CVE-2026-24537

Unauthenticated Cross Site Request Forgery CSRF in WP Accessibility Helper WAH = 0.6.6 versions...

CVE-2026-24639

Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...

EUVD-2026-48248

Cross-Site Request Forgery CSRF vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0...

CVE-2026-57626

The CVE-2026-57626 entry concerns a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress MailPoet plugin, affecting versions 5.30.0 through 5.33.0. Affected component: MailPoet plugin for WordPress. Root cause and exact exploit details are not provided in the connected documents, but ...

CVE-2026-57626 WordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0...

PYSEC-2026-3485 meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

Server-Side Request Forgery SSRF in uploadadimage via Unrestricted imageurl Fetch Summary The uploadadimage MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled imageurl parameter directly to an HTTP fetch helper httpx.AsyncClientfollowredirects=True.geturl without any scheme, host, or...

PYSEC-2026-3541 TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

Impact The /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the TensorZero objectstorage configuration. By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may...

TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

ImpactThe /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the TensorZero objectstorage configuration.By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may...

PYSEC-2026-3524 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

praisonai-platform: default JWT signing secret dev-secret-change-me Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai-platform on PyPI Latest version and version tested: 0.1.4,...

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

SummaryA Server-Side Request Forgery SSRF vulnerability in the SearxNG / searchweb search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The searxngurl argument is passed directly to requests.get with no validation of...

PYSEC-2026-3530 PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

Summary A Server-Side Request Forgery SSRF vulnerability in the SearxNG / searchweb search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The searxngurl argument is passed directly to requests.get with no validation of...