CVE-2026-63301

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

CVE-2026-59895

A flaw was found in Hono, a web application framework. The cx function within hono/css improperly handles class names during server-side rendering. This allows an attacker to inject untrusted values into a JSX class attribute, leading to the injection of arbitrary markup. This could result in...

CVE-2026-59896

A flaw was found in Hono, a Web application framework. The hono/jsx component did not properly isolate context values per request during server-side rendering. This allowed data from a different in-flight request to be used after an asynchronous operation in a component. This could lead to...

BIT-ELK-2026-63142 Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

CVE-2026-53666

A flaw was found in React Router. If an application is configured to allow attacker-supplied input to modify errors during server-side rendering SSR, a remote attacker could trigger unexpected code execution on the client. This execution could lead to an outbound network request, potentially...

EUVD-2026-49660

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

EUVD-2026-49667

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-65442

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

CVE-2026-61953

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-65442 WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

CVE-2026-65442

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

CVE-2026-65442

CVE-2026-65442 is an unauthenticated Server-Side Request Forgery (SSRF) in the WordPress FormCraft plugin (versions ≤ 3.9.15). The root cause is missing nonce verification and authentication checks on the formcraft3_get AJAX endpoint, allowing an unauthenticated attacker to force the server to is...

CVE-2026-61953

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-61953 WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

CVE-2026-61953

CVE-2026-61953 affects the WordPress plugin Simple Link Directory Pro

CVE-2026-53666

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

CVE-2026-59728

Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Bot...

CVE-2026-53666

CVE-2026-53666 affects React Router versions 6.4.0 through 7.17.0 where attacker-supplied input could overwrite parts of errors captured during SSR, enabling arbitrary constructor execution on the client and triggering outbound network requests. This requires specific, unlikely application-layer ...

CVE-2026-53666 React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...

CVE-2026-53666 React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on...