PT-2026-73150

Name of the Vulnerable Software and Affected Versions Phoca Cart versions 5.0.0 through 6.1.16 Description An unauthenticated attacker can perform a SQL injection on the public shop items page. The issue occurs because the GET array parameters a attribute and s specification are concatenated...

PT-2026-72271

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the efct hw io abort function. When the efct hw reqtag alloc function fails, the error path returns -ENOSPC without releasing the reference previously...

CVE-2026-72813

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

CVE-2026-72813: Uncaught Exception

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

PT-2026-76577

Name of the Vulnerable Software and Affected Versions token-optimizer-mcp versions prior to 5.1.0 Description OS command injection is possible in the smart user tool. An MCP client can execute arbitrary shell commands with the privileges of the user running the server by providing a crafted...

PT-2026-75925

Summary token-optimizer-mcp is vulnerable to OS command injection in the smart user tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/pass...

CVE-2026-19751

CVE-2026-19751 affects EnzoVezzaro mcp-dominican-layer (parse-csv tool). The flaw resides in src/index.ts, where axios.get is invoked with a manipulated csvUrl, enabling server-side request forgery. Exploitation is remote and a PoC exploit has been published. The project uses a rolling release st...

CVE-2026-73482

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

CVE-2026-73481

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

CVE-2026-73482

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

CVE-2026-73482 phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

CVE-2026-73482 phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

CVE-2026-73482

CVE-2026-73482 affects phpList prior to 3.7.0-RC5, where the admin deletion action (GET request to ?page=admins&delete=N) is not protected by CSRF token due to verifyCsrfGetToken bypass. A remote attacker can trick a logged-in super-administrator into loading a crafted URL (e.g., embedded in an i...

EUVD-2026-58229

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

CVE-2026-73482 phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

CVE-2026-73481

CVE-2026-73481 affects phpList

EUVD-2026-58228

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...