EUVD-2026-48316

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary...

CVE-2026-65759

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary...

CVE-2026-65759 Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary...

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but filegetcontents follows 302/301 redirects by default without re-validating the redirect target agains...

Server-side Request Forgery (SSRF)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the webService process. An attacker can access internal services and exfiltrate sensitive da...

GHSA-X445-F3H2-J279 Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

Summary Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider, becaus...

Security update for wget

This update for wget fixes the following issues: CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. CVE-2026-58470:...

SUSE-SU-2026:3206-1 Security update for wget

This update for wget fixes the following issues: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. - CVE-2026-58470...

SUSE-SU-2026:3205-1 Security update for wget

This update for wget fixes the following issues - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58470: server-controlled Content-Range header values can cause an integer overflow in parsecontentrange bsc1271034. -...

Data Quality Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Data Quality allows an unauthorized attacker to elevate privileges over a network...

Azure AI Search Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-48522 DESCRIPTION: PyJWT i...

WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin 3D Flipbook PDF Viewer & Embedder versions = 1.4.2...

CVE-2026-65512

Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...

EUVD-2026-48248

Cross-Site Request Forgery CSRF vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0...

PYSEC-2026-3485 meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

Server-Side Request Forgery SSRF in uploadadimage via Unrestricted imageurl Fetch Summary The uploadadimage MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled imageurl parameter directly to an HTTP fetch helper httpx.AsyncClientfollowredirects=True.geturl without any scheme, host, or...

PYSEC-2026-3541 TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

Impact The /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the TensorZero objectstorage configuration. By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may...

PYSEC-2026-3524 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

praisonai-platform: default JWT signing secret dev-secret-change-me Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai-platform on PyPI Latest version and version tested: 0.1.4,...

PYSEC-2026-3530 PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

Summary A Server-Side Request Forgery SSRF vulnerability in the SearxNG / searchweb search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The searxngurl argument is passed directly to requests.get with no validation of...

PYSEC-2026-3535 praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS

praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI Weakness: CWE-918 Server-Side Request Forgery SSRF. --- Summary The SSRF gua...