CVE-2026-84772

A Server-Side Request Forgery (SSRF) vulnerability was identified in the Broken Link Checker WordPress plugin, affecting versions ≤ 2.4.14 . The flaw is exploitable by users with Editor privileges, allowing them to forge server-side requests. The CVSS 3.1 score is 5.5 (Medium) with a changed scop...

CVE-2026-84772 WordPress Broken Link Checker plugin <= 2.4.14 - Server Side Request Forgery (SSRF) vulnerability

Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...

CVE-2026-84770 WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

EUVD-2026-69938

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

CVE-2026-84764

CVE-2026-84764 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Simply Schedule Appointments , affecting versions 1.6.12.23 and below . The flaw was discovered by Anthony Green of Greenhat Security . The assigned CVSS 3.1 score is 8.8 (High) , reflecti...

CVE-2026-84759 WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...

CVE-2026-84759

CVE-2026-84759 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Activity Log plugin by ArYo, affecting versions ≤ 2.13.1 . The flaw was discovered by Asim Alshaya and is rated CVSS 3.1: 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicati...

SUSE CVE-2026-82659

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw message...

WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by sicksec in WordPress Plugin LiteSpeed Cache versions = 7.9...

WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by John Ryan Albon in WordPress Plugin Mang Board WP versions = 2.3.8...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint

Summary IBM ContextForge MCP Gateway contains a server-side request forgery SSRF vulnerability in its Agent-to-Agent A2A invocation endpoint POST /a2a/agentname/invoke. Unlike every other outbound egress path in the gateway, the A2A invocation path does not pin the DNS-resolved IP address at...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

CVE-2026-81432

The JetStyleManager for Gutenberg WordPress plugin (versions before 1.3.9 ) is vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of protection on certain AJAX actions . An attacker can trick a logged-in user with edit_posts capability (Contributor and above) into performing a crafted ...

SUSE CVE-2026-84196

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...

CVE-2026-84697

Mailpit (open-source mail testing tool) contains a Server-Side Request Forgery (SSRF) vulnerability in its IsInternalIP deny list function (file: internal/tools/net.go). The deny list fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix , all...

EUVD-2026-69724

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...

PT-2026-84786

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...

PT-2026-84860

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.10.3-lts and earlier Description An authenticated workspace user can perform a Server-Side Request Forgery SSRF via the knowledge web-document import and synchronization crawler. The application passes a user-supplied URL to t...

CVE-2026-73474: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2...