CVE-2026-82556

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

CVE-2026-82556 Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

CVE-2026-82556

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiate...

CVE-2026-82556

Forgejo up to 15.0.4 is affected by a server-side request forgery (SSRF) vulnerability in the Repository Migration Handler . The root cause is the use of net.LookupIP in services/migrations/allowlist/is_migrate_allowed.go, where a remote attacker with low privileges can perform a manipulation to ...

CVE-2026-82647

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...

CVE-2026-82648

WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud...

CVE-2026-82647

WWBN AVideo contains a cross-site request forgery (CSRF) vulnerability in sendEmail.json.php . The root cause is the bypass of origin checks and captcha validation , allowing an attacker to craft a malicious web page that, when visited by an authenticated admin, sends emails from the site's conta...

CVE-2026-82647

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...

EUVD-2026-68233

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...

CVE-2026-82647 WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php

WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated administrators to send mail from the site's contact address by bypassing origin checks and captcha validation. Attackers can craft a malicious web page that, when visited by an...

CVE-2026-82544

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function resetuserpassword of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This...

CVE-2026-82544

A cross-site request forgery (CSRF) vulnerability exists in wger-project wger up to version 2.6.0-alpha2 , specifically in the reset_user_password function within the Password Reset component (wger/gym/views/gym.py). A remote attacker can exploit this by manipulating a victim into performing an u...

CVE-2026-82544 wger-project wger Password Reset gym.py reset_user_password cross-site request forgery

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function resetuserpassword of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This...

CVE-2026-82544

A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function resetuserpassword of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. This...

EUVD-2026-68214

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

SUSE CVE-2026-4200

A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a manipulation results in...

PT-2026-83623

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is migrate allowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be...

PT-2026-83558

Name of the Vulnerable Software and Affected Versions jina-ai reader affected versions not specified Description The software disables its private-address guard when deployed outside of Google Cloud environments, which enables unauthenticated attackers to perform server-side request forgery SSRF...

[SECURITY] [DLA 4760-1] roundcube security update

Debian LTS Advisory DLA-4760-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 29, 2026 https://wiki.debian.org/LTS Package : roundcube Version : 1.4.15+dfsg.1-1+deb11u11 1.6.5+dfsg-1+deb12u11 CVE ID : CVE-2026-74997 CVE-2026-74998 CVE-2026-74999...

CVE-2026-82468

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...