PT-2026-110072

Name of the Vulnerable Software and Affected Versions 021is elvix-sdk versions prior to 0.10.2 Description A server-side request forgery exists in the MCP Request Handler component within the file src/mcp/index.ts. A remote attacker can exploit this by manipulating the path argument, allowing the...

PT-2026-109985

mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to...

PT-2026-110141

Name of the Vulnerable Software and Affected Versions Traccar versions 5.7 through 6.16.0 Description A cross-site request forgery issue exists where the OpenID Connect callback fails to validate the OAuth state parameter. This allows an attacker to force a victim to log into an account controlle...

CVE-2026-88903: Improper Neutralization of Input During Web Page Generation

The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key ha...

CVE-2026-108667 JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling the revertRecycleBin endpoint. Attackers can send PUT requests to /airag/prompts/revertRecycleBin with chosen template ids to cle...

CVE-2026-108652

JeecgBoot versions through 3.9.5 are vulnerable to a missing authorization flaw in the SystemApiController updateAvatar handler. This security weakness allows any authenticated user to modify the avatars of other users, including administrators. A low-privileged attacker can exploit this by sendi...

CVE-2026-108645 JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes via /sys/category/edit. Low-privileged attackers can send POST or PUT requests supplying a node id to rename, recode, or move...

CVE-2026-108602

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-27350

The Builderius WordPress plugin (versions 1.4 through 1.4-beta ) is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918). This vulnerability allows an attacker to induce the server to perform unintended requests. The documents do not provide specific details regarding the underlying root ...

CVE-2026-108594 Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch

Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports...

Studio Saelix sencho: Server-side request forgeing vulnerability

The Studio Saelix sencho 0.94.1 and earlier versions have a vulnerability related to server-side request forgery. This vulnerability stems from improper handling of the parameter repourl in the outboundTarget.ts file of the git-sources Browse API Endpoint component, which may lead to server-side...

Studio Saelix sencho: Server-side request forgeing vulnerability

The Studio Saelix sencho version 0.97.1 and earlier have a vulnerability related to server-side request forgery. This vulnerability stems from an improper handling of the isValidRemoteUrl function in the Add Remote Node API Endpoint component’s file backend/src/utils/validation.ts, which may lead...

EUVD-2026-96366

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing...

CVE-2026-108583

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing...

Exploit for Improper Privilege Management in Microsoft

CVE-2026-69414 — Microsoft Malware Protection Engine EoP Explo...

CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

DEBIAN-CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

UBUNTU-CVE-2026-108553

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating...

CVE-2026-108554

PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...