CVE-2026-13365 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2026-13365

IBM Planning Analytics Local (affected: 2.0 and 2.1 Local) is vulnerable to cross-site request forgery (CSRF) via CVE-2026-13365. The flaw allows an attacker to perform malicious actions on behalf of an authenticated user when the user visits a crafted page, as described in the IBM Security Bulle...

EUVD-2026-58360

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2026-72658

CVE-2026-72658 describes a Cross-Site Request Forgery (CWE-352) in Kibana that can lead to privilege escalation when a user who can create visualizations saves a specially crafted Vega visualization. When another user opens that visualization, authenticated requests are issued in the viewing user...

CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

EUVD-2026-58198

Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...

CVE-2026-58314

Two SSRF findings in Gitea 1.26.2...

CVE-2026-58314 Two SSRF findings in Gitea 1.26.2

Two SSRF findings in Gitea 1.26.2...

CVE-2026-73575

In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...

CVE-2026-73575

CVE-2026-73575 affects Zimbra Collaboration (ZCS) pre-10.1.17. A CSRF vulnerability exists in the Exchange Web Services (EWS) endpoint caused by insufficient validation of request content types. An attacker could induce an authenticated user to submit a crafted request, potentially allowing unaut...

CVE-2026-66704

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

CVE-2026-66654

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...

EUVD-2026-57907

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

EUVD-2026-57893

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-99)

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when i...

CVE-2026-18699

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:31+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

CVE-2026-18694

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:19+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

CVE-2026-46382

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...