PT-2026-78289

Name of the Vulnerable Software and Affected Versions Animation Addons for Elementor versions prior to 2.7.2 Description Insufficient validation of user-supplied values allows unauthenticated users to manipulate the host of a server-side HTTP request. This enables the site to issue requests to...

PT-2026-79942

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

PT-2026-78376

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An unauthenticated attacker with remote access can exploit a Server-Side Request Forgery SSRF issue, which is a flaw that allows a requester to induce the server to make requests t...

CVE-2026-66602

A CSRF vulnerability (CVSS 8.8, HIGH) affects the HashBar – WordPress Notification Bar plugin through version 2.0.0, discovered by Brian Willows. An attacker can force an authenticated admin to perform unintended actions (e.g., changing settings) via a crafted link. Exploitation evidence includes...

WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Brian Willows in WordPress Plugin HashBar – WordPress Notification Bar versions = 2.0.0...

CVE-2026-71018

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via...

Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty, which are bundled with IBM WebSphere Remote Server, are affected by a server-side request forgery (CVE-2026-14529)

Summary IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are shipped with IBM WebSphere Remote Server. Information about a security vulnerability affecting IBM WebSphere Application Server and IBM WebSphere Application Server Liberty has been published in a security...

EUVD-2026-61741

Vulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

GHSA-XPMJ-WJCP-6PWW Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

Cross-site Request Forgery (CSRF)

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the editApiKey process. An attacker can modify API key properties, such as adding unauthorized IP addresses to the whitelist or extending the validi...

Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection

Summary The Froxlor AJAX endpoint lib/ajax.php is missing Cross-Site Request Forgery CSRF protection. While the main application lib/init.php enforces CSRF token validation on all state-changing HTTP requests POST/PUT/PATCH/DELETE, the standalone lib/ajax.php endpoint bypasses this mechanism...

CVE-2026-68922

creationtimestamp| type| source ---|---|--- 2026-08-18 20:35:06+00:00| published-proof-of-concept| https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-8j49-mmcx-4mp5...

CVE-2026-55593 Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The...

EUVD-2026-61211

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...

CVE-2026-47719 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the DEVICEWEBAPIREQUEST and DEVICEPROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote...

CVE-2026-55166

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acmeurl without an effective server-side destination restriction and trigger AcmeHandler.setupacmeclient to make backend requests. An attacker could target cloud instance metadata or...

CVE-2026-70666

CVE-2026-70666 is a Server-Side Request Forgery (SSRF) in Lemur (Netflix's TLS certificate manager), rated CVSS 7.4 HIGH . Two defects combine: the acme_url allowlist is validated only at authority creation, not on the PUT /api/1/authorities/ update path, and the ACME client follows server-suppli...

CVE-2026-70666 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

EUVD-2026-61155

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...