PT-2026-125066

Applications that pass attacker-controlled URLs to webpage versions before 2.1.0 may be vulnerable to server-side request forgery SSRF or local file disclosure. HTTP::fetch and Webpage::from url passed URLs to libcurl without restricting the URL scheme or validating the resolved destination IP...

PT-2026-117652

Name of the Vulnerable Software and Affected Versions TiBillet Lespass versions up to 10e87909c5d526dffa6d424c104fc12860740537 Description A weakness in the APIv1 component allows for server-side request forgery, a condition where an attacker can induce the server to make requests to an unintende...

CVE-2026-111664

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses versi...

CVE-2026-111664 Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses versi...

CVE-2026-111664

Safing Portmaster versions prior to 2.2.5 are vulnerable to a missing authorization issue. Unprivileged local processes can call the POST /api/v1/updates/from-url endpoint, which is registered with api.PermitAnyone. This allows an attacker to provide an attacker-controlled index URL to bypass ver...

CVE-2026-111664 Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses versi...

CVE-2026-111664

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses versi...

CVE-2026-111664 Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/updates/from-url

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses versi...

EUVD-2026-102955

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses versi...

CVE-2026-111664: Missing Authentication for Critical Function

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses versi...

PT-2026-116063

🚨 CVE-2026-111664 Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL...

Safing Portmaster Authorization Issue Vulnerability

Versions of Safing Portmaster prior to 2.2.5 have a vulnerability related to authorization verification. This vulnerability arises from the lack of authorization checks; local processes with privileged access can force updates by calling the POST /api/v1/updates/from-url endpoint. Attackers can...

CVE-2026-96671

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

CVE-2026-96671

The fifu.app Featured Image from URL WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 6.0.7 . This flaw allows an attacker to perform unauthorized actions by tricking a victim's browser into making unintended requests. The severit...

CVE-2026-96671 WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

EUVD-2026-95611

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

CVE-2026-96671 WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

CVE-2026-96671: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

PT-2026-108863

Cross-Site Request Forgery CSRF vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7...

WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by ChuongVN in WordPress Plugin Featured Image from URL versions = 6.0.7...