62123 matches found
CVE-2026-108521
A server-side request forgery (SSRF) vulnerability exists in Studio-Saelix Sencho up to version 0.97.1 . The flaw is located in the isValidRemoteUrl function within the backend/src/utils/validation.ts file of the Add Remote Node API Endpoint component. An authenticated user with node-management p...
CVE-2026-108521 Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...
PT-2026-110141
Name of the Vulnerable Software and Affected Versions Traccar versions 5.7 through 6.16.0 Description A cross-site request forgery issue exists where the OpenID Connect callback fails to validate the OAuth state parameter. This allows an attacker to force a victim to log into an account controlle...
PT-2026-110104
Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 4.11.0 Description A remote server-side request forgery exists in the Proxy Validation component. The issue occurs within the CasP3ProxyValidate function located in the controllers/cas.go file, where manipulation of t...
PT-2026-110072
Name of the Vulnerable Software and Affected Versions 021is elvix-sdk versions prior to 0.10.2 Description A server-side request forgery exists in the MCP Request Handler component within the file src/mcp/index.ts. A remote attacker can exploit this by manipulating the path argument, allowing the...
CVE-2026-27350
The Builderius WordPress plugin (versions 1.4 through 1.4-beta ) is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918). This vulnerability allows an attacker to induce the server to perform unintended requests. The documents do not provide specific details regarding the underlying root ...
EUVD-2026-96366
zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing...
CVE-2026-108583
zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing...
DEBIAN-CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...
CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...
UBUNTU-CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...
CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...
CVE-2026-108554
PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...
EUVD-2026-96348
PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...
CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...
CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...
EUVD-2026-96347
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...
CVE-2025-57310
CVE-2025-57310 A Cross-Site Request Forgery CSRF vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code. CWE CWE-352: Cross-Site Request Forgery CSRF CVSS v3.1 Base Score: 8.8 High...
Linux Distros Unpatched Vulnerability : CVE-2026-108553
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet...
PT-2026-109674
Name of the Vulnerable Software and Affected Versions zotero-mcp versions 0.10.0 through 0.14.1 Description A server-side request forgery SSRF issue exists where the fetch embedded metadata function fetches URLs without validating the destination. Attackers can use prompt injection to force the...