CVE-2026-105154

Cross-Site Request Forgery CSRF in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a craft...

CVE-2026-105154 Apache Roller: Cross-site request forgery in Planet administration lets an attacker make the server fetch arbitrary URLs

Cross-Site Request Forgery CSRF in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a craft...

CVE-2026-105154

Apache Roller versions 4.0 through 6.1.6 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the Planet feed aggregator administration. An unauthenticated attacker can trick a logged-in global administrator into opening a crafted web page, causing the Roller server to fetch a user-chose...

CVE-2026-123839

In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model...

CVE-2026-123839

In JetBrains IntelliJ IDEA versions prior to 2026.3 , a vulnerability exists where an attacker can trigger the opening of arbitrary URLs without confirmation . This occurs specifically through the Remote Development port forwarding model . The underlying cause is identified as CWE-357 (Insufficie...

EUVD-2026-118342

In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model...

CVE-2026-123839

In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model...

CVE-2026-123839: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote…

In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model...

CLEANSTART-2024-RX24288 malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

Security vulnerability affects the thunderbird package. A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data...

CLEANSTART-2024-GD40306 malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

CVE-2023-5725 affects multiple packages. A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data. See references for individual vulnerability details...

CVE-2026-116205

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying |URL wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal...

CVE-2026-104470

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services...

CVE-2026-104442

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

EUVD-2026-91453

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

PT-2026-104252

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

CVE-2026-104442: Server-Side Request Forgery (SSRF)

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read bac...

CVE-2026-103291 Ghost 3.20.2 before 6.51.0 SSRF via image-size fetch

Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs. Attackers can point image cards at attacker-controlled hosts or internal network...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2023_6188)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20236188 advisory. Mozilla: Queued up rendering could have allowed websites to clickjack CVE-2023-5721 Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, an...

CVE-2026-86173

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the allowlist control by exploiting the default empty...

CVE-2026-85662

Marqo 2.26.0 contains a server-side request forgery vulnerability in the adddocuments endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit downloadimagefromurl and fetchcontentsample functions which...