EUVD-2026-88618

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

EUVD-2026-88561

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

CVE-2026-67993

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

PT-2026-102524

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.34.00.16 Description A Cross-Site Request Forgery CSRF issue exists where an unauthenticated attacker with remote access could potentially exploit the flaw. This could lead to...

CVE-2026-67993: Cross-Site Request Forgery (CSRF)

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

CVE-2026-73597: Cross-Site Request Forgery (CSRF)

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery CSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Launch of...

CVE-2026-67993

The basecamp/upright software, specifically at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f , is vulnerable to a login cross-site request forgery (CSRF) issue. This vulnerability exists within the static credentials callback . While the impact is categorized as high severity (CVSS 8.8) involvi...

CVE-2026-73599: URL Redirection to Untrusted Site

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site 'Open Redirect' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2026-67993

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95362): chromium -- security fixes

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-89426

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

PT-2026-102895

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download file and scrape web agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata...

CVE-2026-101093

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

CVE-2026-101093 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

CVE-2026-101093 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

CVE-2026-101093

Cotonti versions through 1.0.0 are vulnerable to a Cross-Site Request Forgery (CSRF) in the admin.users.php component. The root cause is a lack of token verification when deleting user groups. An attacker can craft malicious links or pages that trick an authenticated administrator into deleting c...

GO-2026-6522 Obot: Server-Side Request Forgery via remote MCP server URL in github.com/obot-platform/obot

Obot: Server-Side Request Forgery via remote MCP server URL in github.com/obot-platform/obot...

Security Bulletin: IBM DataPower Gateway affected by server-side request forgery (CVE-2026-14521)

Summary IBM DataPower Gateway affected by server-side request forgery CVE-2026-14521 Vulnerability Details CVEID:CVE-2026-14521 DESCRIPTION: IBM DataPower Gateway is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the...

CVE-2026-82375 Apache Roller: Server-side request forgery via entry trackback and enclosure URLs

Server-Side Request Forgery SSRF in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standar...