CVE-2026-110100: Missing Authorization

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse getheaders an...

PT-2026-112339

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Server-side request forgery SSRF allows an authorized attacker to elevate privileges over a network. SSRF is a flaw where a server is tricked into making requests to an...

PT-2026-111844

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server,...

PT-2026-111415

Name of the Vulnerable Software and Affected Versions conductor-oss conductor version 3.22.0 Description An issue exists in the MCP Service component within the MCPService.listTools function. A remote attacker can perform server-side request forgery SSRF—a technique that allows an attacker to...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Axios vulnerabilities (USN-8638-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8638-1 advisory. Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NOPROXY rules. An attacker...

CVE-2026-108939 EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function isglobalip of the file mistralrs-server-core/src/mediasource.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

CVE-2026-108939

The EricLBuehler mistral.rs library (versions up to 0.9.3 ) is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The flaw exists in the is_global_ip function within the mistralrs-server-core/src/media_source.rs file, where manipulation of the ip argument allows for remote exploita...

CVE-2026-108939 EricLBuehler mistral.rs media_source.rs is_global_ip server-side request forgery

A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. Impacted is the function isglobalip of the file mistralrs-server-core/src/mediasource.rs. Such manipulation of the argument ip leads to server-side request forgery. The attack can be launched remotely. The exploit has been...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the absence of CSRF protection on state-changing endpoints when OAuth cookie-based authentication is in use. An attacker can trick an authenticated user into visiting a malicious page that issues forg...

CVE-2022-51020

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

[SECURITY] [DSA 6556-1] nagios4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6556-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 12, 2026 https://www.debian.org/security/faq -...

EUVD-2026-97730

Cross-Site Request Forgery CSRF vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17...

CVE-2026-109319

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via...

CVE-2026-108909

A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public a...

CVE-2026-108909 Netcore NR268 CGI Endpoint cross-site request forgery

A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public a...

CVE-2026-108909

A security flaw in Netcore NR268 1.7.121109 allows for cross-site request forgery (CSRF) via the CGI Endpoint component. An attacker can initiate this attack remotely by performing manipulation on the affected functionality. The exploit has been released to the public and may be used for attacks....

EUVD-2026-97569

A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public a...

EUVD-2026-97555

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resultin...

CVE-2026-85960

Progress MarkLogic Server (12.x before 12.1.0 and 11.x before 11.3.7) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the Query Console due to the use of predictable CSRF tokens. A remote attacker could trick an authenticated user into visiting a malicious page to submit unauthorized...

EUVD-2026-97621

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via...