CSRF (Cross-Site Request Forgery) nanoid Dependency in Jira Software Data Center

This High severity CSRF Cross-Site Request Forgery vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This CSRF Cross-Site Request Forgery vulnerability, with a CVSS Score of 7.4 and a...

CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

NPM: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

NPM: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, 2.4.5...

GHSA-FPH4-WMHF-6FWF fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Impact fast-uri decodes a hostname's percent escapes twice in a single normalize or resolve call: once during parsing and again during authority recomposition. A nested percent-encoded host therefore survives the first decode and is turned into a live destination by the second, so...

EUVD-2026-70128

Jenkins LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL...

CVE-2026-8151 Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

CVE-2026-8151 Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

CVE-2026-73474

Server-Side Request Forgery SSRF vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2...

EUVD-2026-69991

Server-Side Request Forgery SSRF vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2...

CVE-2026-73474

The Drupal Entity Share Websub module (versions 0.0.0 through 1.1.2 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is the insufficient validation of certain inputs , which allows an attacker to coerce the server into making unauthorized requests to internal or external r...

CVE-2026-73474 Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097

Server-Side Request Forgery SSRF vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2...

CVE-2026-73474 Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097

Server-Side Request Forgery SSRF vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2...

CVE-2026-84772

Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...

CVE-2026-84759

Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...

CVE-2026-84764

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

CVE-2026-84770

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...

EUVD-2026-69943

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...

EUVD-2026-69940

Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...

CVE-2026-84772

A Server-Side Request Forgery (SSRF) vulnerability was identified in the Broken Link Checker WordPress plugin, affecting versions ≤ 2.4.14 . The flaw is exploitable by users with Editor privileges, allowing them to forge server-side requests. The CVSS 3.1 score is 5.5 (Medium) with a changed scop...