EUVD-2026-36684

A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may b...

PT-2026-49328

Name of the Vulnerable Software and Affected Versions shlink version 5.0.1 Description A Server-Side Request Forgery SSRF exists in the automatic short URL title resolution component. This allows attackers to scan internal resources by providing a crafted longUrl variable. Recommendations At the...

PT-2026-49329

Name of the Vulnerable Software and Affected Versions Benjamin Jonard Koillection version 1.8.0 Description An authenticated Server-Side Request Forgery SSRF exists in the custom scraper subsystem component. This allows attackers to scan internal resources by supplying a crafted URL. SSRF is a fl...

CVE-2026-50888

An authenticated Server-Side Request Forgery SSRF in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL...

PT-2026-49221

WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxe...

CVE-2026-50888

The Benjamin Jonard Koillection v1.8.0 software contains an authenticated Server-Side Request Forgery (SSRF) vulnerability within its custom scraper subsystem component. This flaw allows an authenticated attacker to scan internal network resources by providing a crafted URL, effectively tricking ...

CVE-2026-50888

An authenticated Server-Side Request Forgery SSRF in the custom scraper subsystem component of Benjamin Jonard Koillection v1.8.0 allows attackers to scan internal resources via supplying a crafted URL...

The vulnerability of the functions File::prohibitWrappers() and IOFactory::load() in the PHP library PhpSpreadsheet allows a attacker to perform an SSRF attack or execute arbitrary code.

The vulnerability of the functions File::prohibitWrappers and IOFactory::load in the PHP spreadsheet library PhpSpreadsheet is related to deficiencies in the deserialization mechanism when processing the parameter filename. Exploiting this vulnerability can allow an attacker to perform an SSRF...

CVE-2026-50887

A Server-Side Request Forgery (SSRF) vulnerability exists in the automatic short URL title resolution component of shlink v5.0.1 . This flaw allows an attacker to scan internal resources by supplying a crafted longUrl variable. At this time, no information regarding a newer version containing a f...

CVE-2026-50887

A Server-Side Request Forgery SSRF in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl...

PT-2026-49205

WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML pages that execute unwanted poll operations when administrators visit the page while logged in...

PT-2026-49212

WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via lzcs...

PT-2026-49172

Name of the Vulnerable Software and Affected Versions python-utcp version 1.1.0 Description A server-side request forgery SSRF exists in the utcp-gql/utcp-websocket component of the universal-tool-calling-protocol. This issue allows a remote attacker to initiate a manipulation that results in the...

PT-2026-49346

Name of the Vulnerable Software and Affected Versions LobeHub versions prior to 2.1.57 Description An unauthenticated Server-Side Request Forgery SSRF exists in the '/webapi/proxy' endpoint. The route handler in src/app/backend/webapi/proxy/route.ts fails to implement the checkAuth function, whic...

PT-2026-49348

Administrator Server Side Request Forgery SSRF in PopAd = 1.0.4 versions...

PT-2026-49497

Unauthenticated Cross Site Request Forgery CSRF in WP Migrate Lite = 2.7.8 versions...

Use Of Hard-coded Cryptographic Key

github.com/dhax/go-base is vulnerable to Use of Hard-coded Cryptographic Key. The vulnerability is due to a hardcoded JWT signing secret "random" being used as both the default configuration and programmatic fallback, combined with an ineffective mitigation that only replaced the exact value...

Exploit for Cross-Site Request Forgery (CSRF) in Jupyter Jupyterhub

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form...

Cross-site Request Forgery (CSRF)

github.com/juev/nebula-mesh is vulnerable to Cross-site Request Forgery CSRF. The vulnerability is due to missing CSRF protection on /ui/ state-changing endpoints, where requests are processed based solely on a valid session cookie, allowing attackers to perform unauthorized administrative action...

SUSE CVE-2026-34181

Issue Summary: The PKCS12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 PBMAC1 integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service...