CVE-2026-102797 WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0...

CVE-2026-102797

The ThemeREX Addons plugin for WordPress (versions

CVE-2026-102797 WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0...

CVE-2026-104470

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services...

CVE-2026-104451

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId...

CVE-2026-104448

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

CVE-2026-104452

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, ...

CVE-2026-104447

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

CVE-2026-104421

Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an honest block's header hash, causing Request::KnownBlock to sk...

EUVD-2026-91579

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fastsettinginternetset of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carrie...

CVE-2026-104611 Tenda AC9 POST Request fast_setting_internet_set stack-based overflow

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fastsettinginternetset of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carrie...

CVE-2026-104611 Tenda AC9 POST Request fast_setting_internet_set stack-based overflow

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fastsettinginternetset of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based buffer overflow. The attack is possible to be carrie...

CVE-2026-104611

A stack-based buffer overflow vulnerability exists in the Tenda AC9 (version 15.03.02.13). The flaw is located within an unknown function in the /goform/fast_setting_internet_set file of the POST Request Handler component. By manipulating the netWanType argument, an attacker can trigger the overf...

CVE-2026-86537 Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service

Uncaught exception, Loop with unreachable exit condition 'infinite loop', Integer underflow wrap or wraparound vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-86537 Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service

Uncaught exception, Loop with unreachable exit condition 'infinite loop', Integer underflow wrap or wraparound vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

EUVD-2026-91464

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the deletetag parameter via top-level navigation, carrying the...

CVE-2026-104453

YesWiki versions prior to 4.6.7 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability within the admintag action. The root cause allows an attacker to delete tag associations by luring authenticated administrators into clicking crafted GET links. By supplying a wide ID range in the...

CVE-2026-104452

Versions of YesWiki prior to 4.6.7 are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability within the filemanager page handler . The root cause is the failure to validate a CSRF token on GET requests that perform file operations. An attacker could trick a logged-in administrator or p...

CVE-2026-104451

YesWiki versions prior to 4.6.7 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the RevisionsHandler component. The root cause is the lack of CSRF token validation for GET requests , which allows an attacker to trick users with write capabilities into navigating to a URL containing ...

CVE-2026-104451 YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId...