CVE-2026-90984 Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-90984

The Generate PDF using Contact Form 7 WordPress plugin (versions before 4.2.2 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The issue arises because the plugin's PDF renderer does not restrict the destination of image fetches performed on submitted form content. An at...

CVE-2026-90984 Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form Field

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

EUVD-2026-82683

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-90984: Server-Side Request Forgery (SSRF)

The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generat...

CVE-2026-67101: Server-Side Request Forgery (SSRF)

HCL BigFix Service Management is affected by a Server-Side Request Forgery SSRF vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet...

CVE-2026-56597: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets...

CVE-2026-93839: Missing Authentication for Critical Function

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pdregister WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket...

CVE-2026-76900: Server-Side Request Forgery (SSRF)

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through...

CVE-2026-93765: Use of Externally-Controlled Input to Select Classes or Code

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field...

ROS-20260918-73-0003

The vulnerability of rds component of the Linux operating system’s kernel is related to incomplete recognition of its internal state. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary oras-go's pagination helper parseLink in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host e.g., a cloud metadata...

CVE-2026-61793

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /og/d/ route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParam...

CVE-2026-92963 vm2 before 3.11.2 Information Disclosure via Internal State

vm2 versions before 3.11.2 fail to properly restrict access to the VM2INTERNALSTATEDONOTUSEORPROGRAMWILLFAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals...

BIT-MONGODB-2026-18704 Improper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations

An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation stage being reachable by external clients without an...

crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leaka...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

CVE-2026-92993: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

CVE-2026-90412: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...

CVE-2026-92992: Missing Authorization

A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The...