CVE-2026-109207: Improper Neutralization of Input During Web Page Generation

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:thumbnail@url' parameter in all versions up to, and including, 5.2.11 due to insufficient input sanitization and output...

CVE-2026-111664: Missing Authentication for Critical Function

Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses versi...

CVE-2026-59970: Server-Side Request Forgery (SSRF)

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space,...

PT-2026-115460

Name of the Vulnerable Software and Affected Versions Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 4.0.9 Description Insufficient input validation in the Topbar component's back button handler allows unauthenticated attackers to perform DOM-Based...

CVE-2026-111662: Server-Side Request Forgery (SSRF)

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService,...

CVE-2026-14452: URL Redirection to Untrusted Site

Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...

CVE-2026-111713: Improper Neutralization of Input During Web Page Generation

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

PT-2026-116063

🚨 CVE-2026-111664 Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL...

PT-2026-116061

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. Attackers can target loopback, private, or cloud-metadata addresses through FetchLinkCardService,...

CVE-2026-68571: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted...

PT-2026-115525

Name of the Vulnerable Software and Affected Versions Social Share Buttons versions prior to 1.31 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the share...

CVE-2026-111385: URL Redirection to Untrusted Site

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

PT-2026-115450

Name of the Vulnerable Software and Affected Versions SiteOrigin CSS versions prior to 1.6.8 Description Stored DOM-Based Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via the comment...

PT-2026-116119

🚨 CVE-2026-111720 fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopbac...

PT-2026-116112

Name of the Vulnerable Software and Affected Versions tarteaucitron.js versions prior to 1.37.0 Description A cross-site scripting issue exists because the getElemAttr function resolves attributes prefixed with data-, whereas the https-only guard only validates the unprefixed version of the...

CVE-2026-111323

RedAmon versions through 7.0.1 are vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) via the POST /tradecraft/verify endpoint. The root cause is that the validate_url function only verifies the initial hostname, allowing attackers to provide a public URL that performs a redirect...

CVE-2026-111321

The software TaskingAI versions up to and including 0.3.0 is vulnerable to a Server-Side Request Forgery (SSRF) flaw. The root cause is the processing of an unvalidated OpenAPI servers[0].url within a user-defined action. Authenticated attackers possessing a project API key or console admin login...

CVE-2026-111321 TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...

CVE-2026-111321 TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...

CVE-2026-111313

The JobOps software (versions through 0.13.1 ) is vulnerable to a Server-Side Request Forgery (SSRF) in the POST /api/manual-jobs/fetch handler. This flaw allows authenticated users or unauthenticated clients in demo mode to force the server to fetch internal destinations by supplying loopback, p...