CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103542 formtools.org Form Tools AJAX Endpoint actions.php smart_fill server-side request forgery

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

EUVD-2026-90502

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

CVE-2026-103542

A server-side request forgery (SSRF) vulnerability exists in formtools.org Form Tools versions up to 3.1.1 . The flaw is located in the AJAX Endpoint component, specifically within the smart_fill function of the /global/code/actions.php file. This vulnerability is triggered by the manipulation of...

CVE-2026-76143

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...

EUVD-2026-90485

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter...

CVE-2026-76143

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter. The provided documents do not specify the exact affected version, the specific component or file involved, or the specific remediation steps....

CLEANSTART-2024-ND97566 HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023

Security vulnerability affects the nghttp2 package. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Chromium CVE-2026-87595: Server-side request forgery in Mobile

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

MAL-2026-17437 Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

CVE-2026-13313

An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected...

CVE-2026-13313

An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass security mechanisms and enable the Telnet service, thereby executing arbitrary commands with root privileges and potentially affecting other devices connected...

CVE-2026-34189: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. This issue affects Pandora FMS: from 777 onwards...

PT-2026-103823

Name of the Vulnerable Software and Affected Versions Ghost versions 3.20.2 through 6.50.9 Description An issue exists in image dimension refetching that allows authenticated staff users to perform Server-Side Request Forgery SSRF. SSRF is a flaw where an attacker can induce the server to make...

PT-2026-103980

Name of the Vulnerable Software and Affected Versions Cadmos LTI versions prior to 2026-09-02 Description The application had Laravel debug mode enabled in a publicly accessible environment. An unauthenticated attacker could send a GET request to trigger an unhandled exception, leading to the...

PT-2026-105108

Kyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist 169.254.169.254, 169.254.169.253, metadata.google.internal, 127.0.0.0/8, ::1/128 and the scoped-token control were wired only into the new CEL http.Get/Post library and were never applied to the legac...

PT-2026-103817

Name of the Vulnerable Software and Affected Versions Ghost versions 5.19.0 through 6.57.0 Description A cross-site request forgery CSRF issue exists in the post feedback functionality. This allows attackers to submit feedback on behalf of authenticated users by crafting a malicious link to the...

WS-2026-0150

litellm 1.53.1 to 1.94.2: the proxy request-body blocklist rejects vertexcredentials but not its alias vertexaicredentials, so an authenticated user can pass an externalaccount credential that makes the proxy read any local file and send it to an attacker URL GHSA-g5ff-637f-6q2m...

PT-2026-103736

Name of the Vulnerable Software and Affected Versions Autoptimize versions prior to 3.1.15.2 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...