CVE-2026-69101 Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint

Datavane TIS v5.0.0 contains an XML external entity XXE injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an...

CVE-2026-69101 Datavane TIS v5.0.0 XXE Injection via doEditWorkflow Endpoint

Datavane TIS v5.0.0 contains an XML external entity XXE injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an...

WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Abduvoris Karimov in WordPress Plugin OttoKit versions = 1.1.35...

CVE-2025-10308

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

CVE-2025-10308

The Astro Booking Engine WordPress plugin is affected by a CSRF (Cross-Site Request Forgery) vulnerability in all versions up to 1.4.0, caused by missing nonce validation on the options deletion function. This allows unauthenticated attackers to delete all plugin settings by tricking a site admin...

EUVD-2025-210726

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

CVE-2025-10308 Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

CVE-2026-19786 francoisjacquet RosarioSIS Modules.php cross-site request forgery

A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressin...

CVE-2026-19786 francoisjacquet RosarioSIS Modules.php cross-site request forgery

A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressin...

CVE-2026-19770

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

CVE-2026-19770 feedmob fm-mcp-servers Download Endpoint index.ts downloadReport server-side request forgery

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

CVE-2026-19770

The CVE-2026-19770 entry affects feedmob fm-mcp-servers 0.0.3, specifically the Download Endpoint’s Download Report function (src/smadex-reporting/src/index.ts). The vulnerability arises from manipulation of the downloadUrl argument, enabling server-side request forgery (SSRF). Exploitation is de...

EUVD-2026-58563

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

CVE-2026-19770

A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is the function downloadReport of the file src/smadex-reporting/src/index.ts of the component Download Endpoint. The manipulation of the argument downloadUrl leads to server-side request forgery. The...

CVE-2026-19765

A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSource of the file src/utils/swagger-parser.ts of the component fetchswagger. Performing a manipulation results in server-side request forgery...

CVE-2026-19765

A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSource of the file src/utils/swagger-parser.ts of the component fetchswagger. Performing a manipulation results in server-side request forgery...

EUVD-2026-58500

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

VulnCheck KEV: CVE-2026-45298

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...

GHSA-QM8R-Q3H4-C3VW

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

CVE-2026-72855

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public...