CVE-2026-108522

A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Performing a manipulation of the argument X-Forwarded-For results in improper authentication. The attack is possible to be carried out remotely...

CVE-2026-108521

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

EUVD-2026-96728

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

CVE-2026-108521

A server-side request forgery (SSRF) vulnerability exists in Studio-Saelix Sencho up to version 0.97.1 . The flaw is located in the isValidRemoteUrl function within the backend/src/utils/validation.ts file of the Add Remote Node API Endpoint component. An authenticated user with node-management p...

CVE-2026-108521 Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

EUVD-2026-96698

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108695 MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108695

The MultiVendorX WordPress plugin (through version 5.0.19 ) is vulnerable to an incorrect authorization flaw (CWE-863) within its settings REST endpoint. Attackers possessing the store_owner role can exploit this by sending POST requests to /wp-json/multivendorx/v1/settings. Because the endpoint ...

CVE-2022-1388-POC

CVE-2022-1388 Poc by PsychoSec Improved POC for CVE-2022-1388 that affects multiple F5 products. This is an improved version of Horizon3's Proof of Concept for CVE-2022-1388: https://github.com/horizon3ai/CVE-2022-1388 This version contains multiple improvements as well as an interactive shell to...

CVE-2026-84254: Missing Authorization

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a...

CVE-2026-108695: Incorrect Authorization

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the storeowner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only...

CVE-2026-108772: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/downloadcache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched...

CVE-2026-108855: Missing Authorization

UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other...

CVE-2026-108755: Allocation of Resources Without Limits or Throttling

Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint. Attackers can send arbitrarily large or concurrent request bodies to POST /api/v1/sns/tenant/event with any UUID, which...

CVE-2026-84258: Improper Neutralization of Input During Web Page Generation

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84251: Missing Authorization

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result,...

CVE-2026-108707: Improper Authentication

WukongHRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal dat...

PT-2026-110028

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to WPForms versions prior to 1.0.4 Description The add-on lacks authorization and Cross-Site Request Forgery CSRF checks when updating options via a REST endpoint. Additionally, it fails to verify if the option being updated...

PT-2026-110029

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Gravity Forms versions prior to 1.0.4 Description The plugin lacks authorization and Cross-Site Request Forgery CSRF checks when updating options through a REST endpoint. Additionally, it fails to verify if the option bein...

PT-2026-110032

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to WPForms WordPress plugin versions prior to 1.0.4 Description An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Site...