CVE-2026-5702

Cross-Site Request Forgery CSRF vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint...

CVE-2026-5702 Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application

Cross-Site Request Forgery CSRF vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint...

EUVD-2026-112743

Cross-Site Request Forgery CSRF vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint...

CVE-2026-5702

The SABBATIC application is affected by a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). This flaw allows an attacker to trick an authenticated user into interacting with a malicious link or page, which then sends unauthorized requests to a vulnerable endpoint. No specific technical r...

CVE-2026-117574

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials fr...

EUVD-2026-112460

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials fr...

CVE-2026-117574

A vulnerability exists in ai-gateway-payload-processing due to an authorization bypass (CWE-639). An authenticated remote attacker can submit a request containing a different tenant's model identifier in the request body or header. Because the service fails to verify authorization before retrievi...

CVE-2026-117574

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials fr...

CVE-2026-67077

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or...

CVE-2026-67077 HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or...

CVE-2026-67077

HCL BigFix AEX is impacted by a Server-Side Request Forgery (SSRF) vulnerability (CWE-918, CWE-441, CWE-610). This flaw allows an attacker to force the application to transmit unauthorized requests to external resources. Consequences of successful exploitation include sensitive information disclo...

EUVD-2026-112033

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or...

PT-2026-129173

Name of the Vulnerable Software and Affected Versions ai-gateway-payload-processing affected versions not specified Description An authenticated remote attacker can perform unauthorized requests and consume another tenant's large language model LLM resources and quotas. The issue occurs because t...

PT-2026-128226

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or...

CVE-2026-115917

A flaw was found in vLLM. The HTTP server configures overly permissive Cross-Origin Resource Sharing CORS policies by default, allowing requests from any origin. A remote attacker can exploit this flaw by tricking a victim into visiting a malicious website, which directs the victim's browser to...

CVE-2024-51435

bloodbank A simple csrf poc found on blood bank system v 1.0...

PT-2026-110800

🚨 CVE-2026-85963 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests,...

CVE-2026-14521

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to...

CVE-2026-14521 IBM DataPower Gateway affected by server-side request forgery

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to...

CVE-2026-14521

The IBM DataPower Gateway is vulnerable to Server-Side Request Forgery (SSRF) (CWE-918) across multiple versions, including 10.5.0.0 - 10.5.0.22 , 10.6.0.0 - 10.6.0.10 , 10.6.1 - 10.6.6 , and 11.0.0.0 - 11.0.0.2 . This vulnerability allows an authenticated attacker to send unauthorized requests f...