PT-2026-63871

Name of the Vulnerable Software and Affected Versions Simple Link Directory Pro versions prior to 15.0.9 Description An unauthenticated Cross-Site Request Forgery CSRF issue exists in the Simple Link Directory Pro plugin for WordPress. This occurs due to missing or incorrect nonce validation—a...

PT-2026-63953

Cross-Site Request Forgery CSRF vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0...

PT-2026-64185

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.4.72 Description A server-side request forgery SSRF issue exists in the '/v1/web/fetch' endpoint. The endpoint accepts a user-controlled url parameter and passes it to an external scraping provider to fetch content...

CVE-2026-65759: Improper Access Control

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary...

PT-2026-64207

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

PT-2026-63950

Unauthenticated Cross Site Request Forgery CSRF in Kwayy HTML Sitemap = 4.0 versions...

Cisco IOS 12.4 HTTP Server Cross-Site Request Forgery (CVE-2008-4128)

According to its self-reported version, Cisco IOS 12.4 is affected by multiple cross-site request forgery CSRF vulnerabilities in the HTTP administration component. An unauthenticated, remote attacker can exploit these by persuading an authenticated user to follow a malicious link, allowing...

PT-2026-63840

Unauthenticated Cross Site Request Forgery CSRF in ApusListing = 1.2.63 versions...

PT-2026-63839

Unauthenticated Cross Site Request Forgery CSRF in Ninja Forms File Uploads Extension = 3.3.26 versions...

PT-2026-64095

Server-Side Request Forgery SSRF in upload ad image via Unrestricted image url Fetch Summary The upload ad image MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled image url parameter directly to an HTTP fetch helper httpx.AsyncClientfollow redirects=True.geturl without any scheme,...

CVE-2026-57626: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0...

PT-2026-63804

Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...

PT-2026-63886

Unauthenticated Cross Site Request Forgery CSRF in GiveWP = 4.16.3 versions...

PT-2026-63882

Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...

PT-2026-63930

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65512: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...

PT-2026-63801

Unauthenticated Cross Site Request Forgery CSRF in WP Accessibility Helper WAH = 0.6.6 versions...

PT-2026-63889

Contributor Server Side Request Forgery SSRF in JetEngine = 3.8.11 versions...

PT-2026-63951

Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...

Server-side Request Forgery (SSRF)

Overview next is a react framework. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through createForwardedActionResponse and createRedirectRenderResult in packages/next/src/server/app-render/action-handler.ts. An attacker can make the server send a forwarded...