CVE-2026-32553

Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...

Exploit for Server-Side Request Forgery in Vercel Next.Js

No d...

CVE-2026-75898 RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...

CVE-2026-66635 WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63...

EUVD-2026-60920

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

CVE-2026-66635

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

CVE-2026-32473 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...

EUVD-2026-60903

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

Exploit for Incorrect Resource Transfer Between Spheres in Python Urllib3

!urllib3https://github.com/urllib3/urllib3/raw/main/docs/sta...

XML External Entity (XXE)

Ambari/Oozie is vulnerable to an XML External Entity XXE. The vulnerability is due to insecure XML parsing using DocumentBuilderFactory without disabling external entity resolution, which allows an attacker to inject malicious XML entities and exploit the application to read arbitrary files from...

Apache Allura vulnerable to server-side request forgery

Overview Apache Allura provided by The Apache Software Foundation contains the vulnerability listed below: Server-side request forgery CWE-918 - CVE-2026-69223 Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

CVE-2026-75151

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

CVE-2026-75151 SourceCodester Onlne Examination & Learning Management System cross-site request forgery

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

EUVD-2026-60567

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

CVE-2026-75151

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

Server-side Request Forgery (SSRF)

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetchimage function in vllm/transformersutils/processors/mimov2omni.py, which directly issues HTTP requests...

CVE-2026-66602: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0...

CVE-2026-66635: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63...

PT-2026-79999

Server-side request forgery ssrf in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network...

CVE-2026-55166: Improper Authorization

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acmeurl without an effective server-side destination restriction and trigger AcmeHandler.setupacmeclient to make backend requests. An attacker could target cloud instance metadata or...