EUVD-2026-57454

SiYuan: The session-cookie signing key Conf.CookieKey is returned to anonymous readers by /api/system/getConf...

EUVD-2026-71753

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device...

CVE-2026-82712

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are affected by a cross-site request forgery (CSRF) flaw that allows an attacker to perform state-changing operations on the device, including factory resets , credential extraction, and data theft. The product is deployed in critical manu...

CVE-2026-82712 Tycon Systems TPDIN-Monitor-WEB3 Cross-Site Request Forgery

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device...

WordPress MStore API plugin <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery vulnerability

Unauthenticated Authentication Bypass via 'idtoken' Parameter JWT Forgery vulnerability discovered by t4g0 in WordPress Plugin MStore API versions = 4.20.0...

CVE-2026-53760

Admidio versions 5.0.11 and prior are affected by a CSRF vulnerability in the modules/plugins.php endpoint. Plugin install, uninstall, and update operations are handled via GET requests without CSRF token validation. Because browsers send SameSite=Lax cookies on top-level navigations, an attacker...

CVE-2026-17631 Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...

EUVD-2026-71462

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...

CVE-2026-17631

Langflow OSS 1.0.0–1.10.2 is vulnerable to a non-blind server-side request forgery (SSRF) (CWE-918) caused by missing URL validation in flow components for LM Studio, Home Assistant, DeepSeek, xAI, Glean, HuggingFace Inference API, Ollama, LiteLLM, and Docling Serve. An authenticated attacker can...

CVE-2026-82911

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-19305

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery...

CVE-2026-19301

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...

EUVD-2026-71597

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery...

CVE-2026-18905 IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

IBM ContextForge MCP Gateway mcp-contextforge-gateway = v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation...

EUVD-2026-71268

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-82911 CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-82911 CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-82911 CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/ordernumber in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-19304 Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy...

CVE-2026-19305

IBM Langflow OSS versions 1.0.0 through 1.11.2 are vulnerable to Server-Side Request Forgery (SSRF) (CWE-918) in multiple components where a remote attacker with no prior authentication can supply attacker-controlled URLs that reach internal network hosts without adequate validation. Affected com...