CVE-2026-97316

The Broken Link Notifier WordPress plugin, specifically versions prior to 2.0.0.1 , is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The root cause is a failure to re-validate the destination of redirects when the plugin checks links. This allows an attacker to bypass the ...

EUVD-2026-89627

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services...

CVE-2026-97316 Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services...

CVE-2026-103057

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-103057 AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-103057

AiSOC versions 5.1.0 before 12.0.0 are vulnerable to an authentication bypass in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push . This flaw allows attackers to post arbitrary events using spoofed tenant identifiers , enabling them to broadcast malicious...

EUVD-2026-89541

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-103057 AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-103057 AiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

CVE-2026-97316: Server-Side Request Forgery (SSRF)

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services...

PT-2026-102967

Name of the Vulnerable Software and Affected Versions AiSOC versions 5.1.0 through 11.9.9 Description An authentication bypass exists in the realtime service internal endpoints 'POST /internal/agent-event' and 'POST /internal/push'. This allows attackers to submit arbitrary events using spoofed...

CVE-2026-102150: Missing Authentication for Critical Function

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form...

CVE-2023-54402: Server-Side Request Forgery (SSRF)

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value testtoken to bypass authentication. Attackers can exploit the unrestricted URL scheme handlin...

CVE-2026-93903: Double Decoding of the Same Data

LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...

PT-2026-103010

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with local access to a node within a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another Pexip Infinity node...

CVE-2026-102136: Improper Neutralization of CRLF Sequences

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...

PT-2026-103569

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description In multi-node deployments, an attacker with existing code execution on one appliance node can submit a value via an internal cluster interface. This value is...

CVE-2026-103057: Missing Authentication for Critical Function

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...

PT-2026-103276

Name of the Vulnerable Software and Affected Versions LiteSpeed Web Server LSWS versions prior to 6.3.7 build 1 Description LiteSpeed Web Server LSWS mishandles internal redirect URL validation in a specific corner case. This issue involves double decoding of the same data, which can lead to...

PT-2026-103541

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description A Server-Side Request Forgery SSRF weakness allows a remote, unauthenticated attacker to force the gateway to send crafted requests to internal or unintended network...