101480 matches found
CVE-2026-19957 graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery
A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is...
CVE-2026-19956
A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...
EUVD-2026-59992
A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...
CVE-2026-19956 gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery
A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...
CVE-2026-19956 gomarble-ai facebook-ads-mcp-server server.py fetch_pagination_url server-side request forgery
A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...
CVE-2026-19956
A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetchpaginationurl of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...
CVE-2026-19956
The CVE-2026-19956 entry concerns gomarble-ai facebook-ads-mcp-server (version 0.1.0). The vulnerable element is fetch_pagination_url in server.py, whose manipulation enables server-side request forgery. Impact is implied as remote exploitable via the affected function, affecting confidentiality/...
CVE-2026-17608
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...
CVE-2026-17608
The CVE concerns the WP Compress – Instant Performance & Speed Optimization plugin for WordPress. A CSRF flaw exists in all versions up to and including 7.10.09 due to missing/incorrect nonce validation on the top-level template code function. This allows unauthenticated attackers to delete arbit...
CVE-2026-17608 WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...
CVE-2026-17608
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...
CVE-2026-17608 WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...
CVE-2026-17123
The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...
CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...
CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery
A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...
PT-2026-73098
Name of the Vulnerable Software and Affected Versions Royal Elementor Addons versions prior to 1.7.1065 Description An issue exists in the Form Builder widget's webhook url setting that allows Server-Side Request Forgery SSRF, a flaw where an attacker forces a server to make requests to an...
Proof-Of-Execution Memory: Defending LLM Agents against Forged-Reasoning Attacks by Verifying What Actually Happened
LLM agents are stateless and rely on external memory to carry context between steps. Because agents treat that memory as trustworthy, an adversary who can write to it can steer their behavior. The FARMA attack does this with no malicious command: it inserts fabricated entries into the agent's...
PT-2026-73073
Name of the Vulnerable Software and Affected Versions OpenBoxes versions prior to 0.9.8-hotfix1 Description A server-side request forgery SSRF exists in the Product Upload Endpoint. A remote attacker can manipulate the params.url variable within the Upload function of the file...
CVE-2026-17608: Cross-Site Request Forgery (CSRF)
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...
