PT-2026-91458

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

PT-2026-91717

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Managed File Transfer could allow an authenticated attacker to read arbitrary files or perform...

PT-2026-91710

A security flaw has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in...

PT-2026-91126

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...

CVE-2026-90599

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The explo...

CVE-2026-90599 Rizwan17 inventory-management-system process.php cross-site request forgery

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The explo...

CVE-2026-90599 Rizwan17 inventory-management-system process.php cross-site request forgery

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The explo...

CVE-2026-90599

A cross-site request forgery flaw exists in Rizwan17 inventory-management-system (GitHub project) in an unknown function of the file includes/process.php . The vulnerability is remotely exploitable with low complexity, requiring user interaction and no prior authentication, yielding a CVSS 3.1 ba...

CVE-2026-90580

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...

CVE-2026-90580

FlowiseAI Flowise (up to version 3.0.2) contains a server-side request forgery (SSRF) vulnerability in the Evaluations Endpoint . The flaw resides in the axios.post function within packages/server/src/controllers/evaluations/index.ts, where manipulation of the Host or X-Forwarded-Proto header all...

CVE-2026-90769 Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services...

EUVD-2026-76917

A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery...

PT-2026-90836

Name of the Vulnerable Software and Affected Versions Open Notebook versions prior to 1.11.0 Description Authenticated users can perform server-side requests to internal services because the application fails to validate the URL parameter in the 'POST /api/sources' endpoint. This allows attackers...

PT-2026-90981

Name of the Vulnerable Software and Affected Versions Rizwan17 inventory-management-system versions up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2 Description A flaw in the file includes/process.php allows for remote cross-site request forgery CSRF, a type of attack that forces an authenticated...

CVE-2026-90486

A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery...

CVE-2026-90486 openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery

A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery...

CVE-2026-90486

A server-side request forgery (SSRF) vulnerability exists in openstatusHQ openstatus , specifically in the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The affected functionality is not further detailed in the provided documents. The vulnerability allows a remote attacker...

CVE-2026-81429

The Export & Import WPBakery Page Builder WordPress plugin (versions through 1.0.2 ) is vulnerable to a CSRF to Stored Cross-Site Scripting flaw. The issue arises because the template-import feature fails to perform CSRF checks and does not sanitise imported data before storing and echoing it. An...

PT-2026-90724

Name of the Vulnerable Software and Affected Versions openstatusHQ openstatus versions up to f04c827112f30a11d571ebdad3892826034d6265 Description A remote attacker can exploit a flaw in the apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts file to perform server-side request forgery...

CVE-2026-90446

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend...