CVE-2026-78279

CVE-2026-78279 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Fluent Support Pro , affecting versions ≤ 2.3.1 . The vulnerability was discovered by Ananda Dhakal (Patchstack). A CVSS 3.1 score of 5.4 (Medium) is assigned, with a network vector, low a...

EUVD-2026-64784

Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78277

FluentCRM Pro , a WordPress plugin, is affected by a Server-Side Request Forgery (SSRF) vulnerability in its Subscriber functionality, impacting versions ≤ 3.1.12 . The vulnerability was discovered by Ananda Dhakal via Patchstack. The CVSS 3.1 score is 4.9 (Medium) , with a network attack vector,...

CVE-2026-78277 WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in FluentCRM Pro = 3.1.12 versions...

CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

EUVD-2026-64834

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

WordPress Eventin plugin < 4.1.21 - Contributor+ Server-Side Request Forgery vulnerability

Contributor+ Server-Side Request Forgery vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Event SOlution versions 4.1.21...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Handshake: The DONE command requires admin permission. ACCEPT and DONE are the two responses of the handshake genl family; both are intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DON...

WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by sanghyeok Kim in WordPress Plugin Hash Form versions = 1.4.0...

WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...

CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For...

CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such...

CVE-2026-56865

A flaw was found in golang.org/x/mod/sumdb/tlog. A malicious Go proxy GOPROXY could exploit this vulnerability by forging sumdb tiles. This allowed the proxy to bypass integrity checks and serve malicious module content to a local Go module cache, which would then go undetected by the transparenc...

Exploit for CVE-2026-15502

Patch: CVE-2026-15502 Vulnerability Details - CVE: CVE...

CVE-2026-78205

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...

CVE-2026-78205 BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...

CVE-2026-78205 BentoML 1.4.19 through 1.4.39 Server-Side Request Forgery via Unfiltered RFC 6598 Shared Address Space

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...

PT-2026-80856

Name of the Vulnerable Software and Affected Versions nektos/act versions 0.2.81 through 0.2.89 Description The software starts an HTTP Artifacts V4 backend when workflows use actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs, including 'CreateArtifact',...

PT-2026-79798

BentoML's outbound connection safeguard make safe connect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs...