WordPress LearnPress plugin < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature vulnerability

Instructor+ Server-Side Request Forgery via openaiapplyimagefeature vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin LearnPress versions 4.4.4...

EUVD-2026-63222

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14951 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14951 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

GHSA-332R-8PMF-8M9P vulnerabilities

Vulnerabilities for packages: wget...

CVE-2026-48022 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

CVE-2026-76795 AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery

A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2026-76795

PullMD 3.2.0's REST API endpoint at /api accepts an unvalidated url argument, enabling remote server-side request forgery (SSRF). CVSS 3.1 scores it HIGH (7.3, network vector, no auth required). A public PoC exploit exists. Upgrade to version 3.3.0 (patch commit 96448894cc93ccecb0bdcbf263a9d25390...

CVE-2026-76795 AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery

A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to th...

EUVD-2026-62895

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into opening a crafted link to Monitoring Console. When the authenticated user opens the link, Splunk Enterprise runs attacker-controlled Search Processing Language SP...

EUVD-2026-63127

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could cause an authenticated user to run arbitrary Search Processing Language SPL searches on their behalf through the Event Type Builder. This could expose all relevant data and stored credentials. Th...

PT-2026-79010

ATutor is vulnerable to Cross-Site Request Forgery CSRF in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token implementation, the forged request is...

PT-2026-79107

Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the OAuth2 consent flow to proceed without restricting approve to POST, without a csrf token in frappe/templates/includes/oauth...

PT-2026-78909

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

PT-2026-78999

Cross-Site Request Forgery CSRF vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7...

PT-2026-79200

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Online affected versions not specified Description Server-side request forgery SSRF allows an unauthorized attacker to elevate privileges over a network. SSRF is a flaw where an attacker can induce the server to make request...

MATEE: Efficiently Bridging the Semantic Gap in TrustZone Via Arm Pointer Authentication

Trusted Execution Environments TEEs employ hardware-based isolation mechanisms to safeguard the confidentiality and integrity of sensitive code and data. One such prevalent implementation is Arm TrustZone, which partitions the system into the secure and normal non-secure worlds. However, this...

PT-2026-79215

Name of the Vulnerable Software and Affected Versions Azure Active Directory affected versions not specified Description Server-side request forgery SSRF, a flaw where an attacker induces a server-side application to make requests to an unintended location, exists in Azure Active Directory. This...

CVE-2026-77074: Improper Control of Generation of Code

n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requests to arbitrary addresses or access...

PT-2026-78923

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user can trigger the server to send repeated requests to internal endpoints, including link-local metadata addresses. This occurs because the...