62970 matches found
PYSEC-2026-3535 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI Weakness: CWE-918 Server-Side Request Forgery SSRF. --- Summary The SSRF gua...
CVE-2026-65536 WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری = 4.4.5 versions...
CVE-2026-65516
Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...
EUVD-2026-48120
Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...
CVE-2026-65516 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...
CVE-2026-65512
CVE-2026-65512 affects the WordPress WP Activity Log plugin (WordPress)
EUVD-2026-48107
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
EUVD-2026-48099
Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...
CVE-2026-65488
The CVE concerns the WordPress plugin LA-Studio Element Kit for Elementor, version <= 1.6.2. It describes an unauthenticated Cross-Site Request Forgery (CSRF) that can lead to Stored XSS. The issue originates from the plugin’s handling of CSRF, enabling an attacker to trigger stored XSS withou...
CVE-2026-65471
Unauthenticated Cross Site Request Forgery CSRF in Avada Core = 5.15.6 versions...
CVE-2026-65466 WordPress JetBooking plugin <= 4.1.2 - Server Side Request Forgery (SSRF) vulnerability
Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...
CVE-2026-65466
CVE-2026-65466 concerns a Server Side Request Forgery (SSRF) in the WordPress JetBooking plugin <= 4.1.2 . The description specifies a custom role -driven SSRF vulnerability affecting JetBooking versions up to 4.1.2. The CVSSv3.1 metrics (source: Patchstack) indicate a network attack vector , ...
CVE-2026-65460 WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...
CVE-2026-65460 WordPress Zarinpal Gateway plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...
EUVD-2026-48182
Unauthenticated Cross Site Request Forgery CSRF in ApusListing = 1.2.63 versions...
CVE-2026-57784 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Ninja Forms File Uploads Extension = 3.3.26 versions...
CVE-2026-24639 WordPress Photo Block plugin <= 1.7.1 - Server Side Request Forgery (SSRF) vulnerability
Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...
CVE-2026-64799
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...
WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kwayy HTML Sitemap versions = 4.0...
EUVD-2026-47915
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...