99515 matches found
CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...
CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...
EUVD-2026-90502
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...
CVE-2026-103542
A server-side request forgery (SSRF) vulnerability exists in formtools.org Form Tools versions up to 3.1.1 . The flaw is located in the AJAX Endpoint component, specifically within the smart_fill function of the /global/code/actions.php file. This vulnerability is triggered by the manipulation of...
Chromium CVE-2026-87595: Server-side request forgery in Mobile
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
spip-exploits
Casse-Spip CVE-2026-72708, CVE-2026-72709, CVE-2026-72710 De una inyecciĆ³n SQL no autenticada a la ejecuciĆ³n remota de cĆ³digo Exploit para CVE-2026-72708, CVE-2026-72709 y CVE-2026-72710 descubiertos por Franck Chevalier Wayko Para un anĆ”lisis tĆ©cnico completo, lea el artĆculo completo en el blog...
cve-2020-10977-read-and-execute
CVE-2020-10977 leer y ejecutar Acerca de CVE-2020-10977 Informe de HackerOne: https://hackerone.com/reports/827052 Exploit-DB: https://www.exploit-db.com/exploits/48431 CĆ³mo reproducir la parte de ejecuciĆ³n manualmente: De la lectura a la ejecuciĆ³n Acerca de este repositorio getsecret.py - script...
AlmaLinux 9.6 [TuxCare] Security Update: munge / munge-devel / munge-libs (ALMALINUX9.6:CLSA-2026:1772572505)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772572505 advisory. - MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer...
Rocky Linux 10.2 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-devel / nodejs-docs / etc Multiple Vulnerabilities (crlsa-2026_55541)
The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202655541 advisory. brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand function CVE-2026-14257 brace-expansion: brace-expansion: Denial of...
VulnCheck KEV: CVE-2026-61500
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's...
Rocky Linux 8 [CIQ] Security Update: krb5-debuginfo / krb5-debugsource / krb5-devel / etc (crlsa-2024_8860)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20248860 advisory. freeradius: forgery attack CVE-2024-3596 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has not...
AlmaLinux 9.2 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1782976762)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782976762 advisory. - Issue summary: The implementations of AES-SIV RFC 5297 and AES-GCM-SIV RFC 8452 mishandle the authentication of AAD Additional...
Critical: amazon-ssm-agent
Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...
AlmaLinux 9.2 [TuxCare] Security Update: ipa-client / ipa-client-common / ipa-client-epn / ipa-client-samba / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778881463)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778881463 advisory. - A Cross-site request forgery vulnerability exists in ipa/session/loginpassword in all supported versions of IPA. This flaw allows ...
AlmaLinux 9.2 [TuxCare] Security Update: freeradius / freeradius-devel / freeradius-doc / freeradius-krb5 / etc (ALMALINUX9.2:CLSA-2025:1743103421)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1743103421 advisory. - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept,...
CentOS Linux 8 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1779461988)
The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1779461988 advisory. - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response...
PT-2026-103969
šØ CVE-2026-104059 Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, ...
CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...
CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...
CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...