CVE-2026-94028

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

CVE-2026-94028 mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

CVE-2026-94028

Mealie (mealie-recipes) versions up to 3.25.1 contain a server-side request forgery (SSRF) vulnerability in the Recipe Action Trigger component, specifically in the payload.model_dump function within mealie/routes/households/controller_group_recipe_actions.py. A remote attacker with low privilege...

CVE-2026-94028 mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

EUVD-2026-83742

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

CVE-2026-94028 mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgery

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

CVE-2026-94028: Server-Side Request Forgery (SSRF)

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

PT-2026-95971

Name of the Vulnerable Software and Affected Versions Mealie versions prior to 3.26.0 Description A weakness in the Recipe Action Trigger component allows for remote server-side request forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. T...

WordPress Booking for Appointments and Events Calendar plugin < 2.4.9 - Unauthenticated Post-Booking Action Trigger vulnerability

Unauthenticated Post-Booking Action Trigger vulnerability discovered by Haitam Lazaar in WordPress Plugin Amelia versions 2.4.9...

CVE-2026-45718

Budibase is an open-source low-code platform. Prior to 3.38.1, the row action trigger endpoint POST /api/tables/:sourceId/actions/:actionId/trigger fails to validate that the user-supplied rowId is within the scope of the view's row filters. A user with access to a filtered view can trigger row...

CVE-2026-45718 Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

Budibase is an open-source low-code platform. Prior to 3.38.1, the row action trigger endpoint POST /api/tables/:sourceId/actions/:actionId/trigger fails to validate that the user-supplied rowId is within the scope of the view's row filters. A user with access to a filtered view can trigger row...

CVE-2026-45718 Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

Budibase is an open-source low-code platform. Prior to 3.38.1, the row action trigger endpoint POST /api/tables/:sourceId/actions/:actionId/trigger fails to validate that the user-supplied rowId is within the scope of the view's row filters. A user with access to a filtered view can trigger row...

CVE-2026-45718 Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

Budibase is an open-source low-code platform. Prior to 3.38.1, the row action trigger endpoint POST /api/tables/:sourceId/actions/:actionId/trigger fails to validate that the user-supplied rowId is within the scope of the view's row filters. A user with access to a filtered view can trigger row...

CVE-2026-45718: Incorrect Authorization

Budibase is an open-source low-code platform. Prior to 3.38.1, the row action trigger endpoint POST /api/tables/:sourceId/actions/:actionId/trigger fails to validate that the user-supplied rowId is within the scope of the view's row filters. A user with access to a filtered view can trigger row...

EUVD-2026-30959

In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage...

NPM: Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

NPM: Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows vulnerability discovered by ? in WordPress Npm budibase versions 3.38.1...

Budibase: Row Action Trigger Bypasses View Row Filter Security Boundary Allowing Action on Out-of-Scope Rows

Summary The row action trigger endpoint POST /api/tables/:sourceId/actions/:actionId/trigger fails to validate that the user-supplied rowId is within the scope of the view's row filters. A user with access to a filtered view can trigger row actions on any row in the underlying table, including ro...

PT-2026-41796

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.38.1 Description The row action trigger endpoint "POST /api/tables/:sourceId/actions/:actionId/trigger" fails to validate if the user-supplied rowId is within the scope of the view's row filters. This allows a user...

CVE-2024-21497

Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirecturl parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this vulnerability,...

CVE-2021-44524: Exposure of Resource to Wrong Sphere

A vulnerability has been identified in SiPass integrated V2.76 All versions, SiPass integrated V2.80 All versions, SiPass integrated V2.85 All versions, Siveillance Identity V1.5 All versions, Siveillance Identity V1.6 All versions V1.6.284.0. Affected applications insufficiently limit the access...