Linux Distros Unpatched Vulnerability : CVE-2026-87859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, whic...

SUSE SLED15: libopenssl-3-devel / libopenssl-3-fips-provider / etc (SUSE-SU-2026:3835-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3835-1 advisory. OpenSSL is updated to 3.5.0 in SLE-15-SP7: jscPED-16072 Enables Post-Quantum Cryptography PQC TLS support...

PT-2026-90031

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

PT-2026-90521

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Requests sent from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange fail to verify the server...

PT-2026-90516

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A deployment mode designed to provide read-only access to stored data fails to restrict request methods on certain application programming interface routes. This...

CVE-2026-81910: Improper Neutralization of Special Elements Used in a Template Engine

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-62139: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

Forging Tree-Ring: Reproducing and Instrumenting Black-Box Semantic Watermark Forgery

Semantic watermarking schemes such as Tree-Ring hide a detectable pattern in the initial noise latent of a diffusion model. Recent work shows these watermarks are not only removable but forgeable: an attacker who never sees the watermarking key can still produce images the genuine detector accept...

PT-2026-89845

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the json decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php ...

PT-2026-89814

Name of the Vulnerable Software and Affected Versions morgan versions prior to 1.12.1 Description The escapeLogField function fails to escape the double quote character used to delimit quoted fields in the Apache combined log format. An unauthenticated remote attacker can exploit this by injectin...

PT-2026-90520

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An example environment-configuration file contains a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis...

CVE-2026-54054

Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version 1.3.0 , its URL import endpoint (POST /api/files/url) is vulnerable to full-read SSRF . The HTTP downloader fetches user-supplied URLs with redirects enabled and does not validate whether the targ...

CVE-2026-80380

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by cross-site request forgery (CSRF) , allowing a remote attacker with no privileges but requiring user interaction to perform unauthorized actions. The flaw is attributed to open source software components within the product, as indicated b...

CVE-2026-80380 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery...

CVE-2026-81213 Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

CVE-2026-82097 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery SSRF vulnerability...

CVE-2026-9667

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to server-side request forgery (SSRF) (CWE-918), allowing a remote, unauthenticated attacker to cause the server to send outbound requests to arbitrary endpoints. The impact is limited to low confidentiality per the CVSS 3.1 score of 5.3...

WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by MYUNGYONG LEE in WordPress Plugin RTMKit versions = 2.1.5...

WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Site Kit by Google versions = 1.186.0...

CVE-2026-84432 Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...