CVE-2026-101064 Obot before v0.23.0 Server-Side Request Forgery via MCP

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and clo...

CVE-2026-100873

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-101061

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

CVE-2026-101060

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.calltool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal...

CVE-2026-101058

python-utcp pip package utcp-http before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensuresecureurl intentionally permits loopback HTTP for...

CVE-2026-100873 mathurvishal CloudClassroom-PHP-Project cross-site request forgery

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-100873 mathurvishal CloudClassroom-PHP-Project cross-site request forgery

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-100873

A cross-site request forgery (CSRF) vulnerability was identified in the mathurvishal CloudClassroom-PHP-Project (specifically in versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be ). The vulnerability exists within an unknown function , allowing for remote attacks. The documents indicate tha...

EUVD-2026-88006

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

EUVD-2026-87986

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

EUVD-2026-87985

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.calltool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal...

EUVD-2026-87979

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

basketcraft

basketcraft este es un script que explota la vulnerabilidad CVE-2023-27163, que es un SSRF en request-baskets versión 1.2.1 SSRF en Request-Baskets CVE-2023–27163 CVE-2023–27163 representa una vulnerabilidad crítica de falsificación de solicitudes del lado del servidor Server-Side Request Forgery...

DEBIAN-CVE-2026-89102

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

AZL-105188 CVE-2026-89102 affecting package mariadb 10.11.19-1

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

CVE-2026-89102

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

CVE-2026-89102

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

UBUNTU-CVE-2026-89102

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

CVE-2026-89102 OCSP stapling v2 multi accepts non-CA chain certificates as issuers

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...

CVE-2026-89102 OCSP stapling v2 multi accepts non-CA chain certificates as issuers

In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVECERTIFICATESTATUSREQUESTV2 feature and calls wolfSSLUseOCSPStaplingV2ssl...