CVE-2026-84482

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...

CVE-2026-84483

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hashhmac with the site's...

CVE-2026-84483 WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hashhmac with the site's...

CVE-2026-84483

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php . An unauthenticated attacker can forge valid HMAC tokens by computing hash_hmac with the site's public base URL as the key and the current time as the message. With forged tokens, an attacker...

CVE-2026-84483 WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hashhmac with the site's...

CVE-2026-84482

WWBN AVideo (through commit 9c39d8c8) contains a cross-site request forgery (CSRF) vulnerability in the get_domain() and isSameDomain() functions, which fail to properly validate referer origins. An attacker can forge requests from sibling subdomains or unparseable long-gTLD origins to perform ad...

CVE-2026-84483 WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attackers to compute valid HMAC tokens using the public site URL and current time. Attackers can forge authentication tokens by computing hashhmac with the site's...

CVE-2026-84482 WWBN AVideo Cross-Site Request Forgery via get_domain() validation

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...

CVE-2026-84482 WWBN AVideo Cross-Site Request Forgery via get_domain() validation

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...

CVE-2026-76851

A Server-Side Request Forgery (SSRF) vulnerability in GitHub Enterprise Server allowed remote code execution on the instance. The root cause was insufficient network isolation that permitted malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests ...

CVE-2026-18730 Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token

A server-side request forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster...

EUVD-2026-55971

TYPO3 CMS - Broken Access Control in Backend and Install Tool...

CVE-2026-83548

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized...

EUVD-2026-69643

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an...

CVE-2026-73757

CVE-2026-73757 is an authenticated SSRF vulnerability in the web-based management interface of HPE AOS-CX . A remote attacker with valid credentials can forge server-side requests to enumerate the internal structure of the host, resulting in potential disclosure and limited modification of sensit...

EUVD-2026-69621

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a server-side request forgery SSRF attack. A successful exploit allows an attacker to enumerate information about the internal structure of the AOS-CX host, leading to potential...

CVE-2021-24901

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:56+00:00| seen| https://t.me/hackingAttack/42050 2026-09-02 01:02:17+00:00| seen| https://t.me/hackingAttack/42050 2026-09-06 10:00:06+00:00| published-proof-of-concept| https://t.me/hackingAttack/42050 2026-09-07 01:00:24+00:00|...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-83551 Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

CVE-2026-8712 Wyoming < 1.10.2 SSRF via uri Query Parameter

Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious uri query parameter to the HTTP API. Attackers can pass arbitrary tcp:// or unix:// URIs...