62039 matches found
CVE-2026-19751 EnzoVezzaro mcp-dominican-layer parse-csv tool index.ts axios.get server-side request forgery
A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...
Cross-site Request Forgery (CSRF)
Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the Vega visualization. An attacker can perform unauthorized actions in the context of another...
CVE-2026-72658
Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...
CVE-2026-13365
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
CVE-2026-13365
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
CVE-2026-13365
IBM Planning Analytics Local (affected: 2.0 and 2.1 Local) is vulnerable to cross-site request forgery (CSRF) via CVE-2026-13365. The flaw allows an attacker to perform malicious actions on behalf of an authenticated user when the user visits a crafted page, as described in the IBM Security Bulle...
CVE-2026-13365 IBM Planning Analytics Local is affected by security vulnerabilities
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
CVE-2026-13365 IBM Planning Analytics Local is affected by security vulnerabilities
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
EUVD-2026-58360
IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...
USN-8638-1: Axios vulnerabilities
Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NOPROXY rules. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. CVE-2025-62718 It was discovered that Axios did...
CVE-2026-72658
CVE-2026-72658 describes a Cross-Site Request Forgery (CWE-352) in Kibana that can lead to privilege escalation when a user who can create visualizations saves a specially crafted Vega visualization. When another user opens that visualization, authenticated requests are issued in the viewing user...
CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()
Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...
CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules
phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...
EUVD-2026-58198
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to...
CVE-2026-58314
Two SSRF findings in Gitea 1.26.2...
CVE-2026-58314 Two SSRF findings in Gitea 1.26.2
Two SSRF findings in Gitea 1.26.2...
CVE-2026-73575
In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...
CVE-2026-73575
In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...
CVE-2026-73575
CVE-2026-73575 affects Zimbra Collaboration (ZCS) pre-10.1.17. A CSRF vulnerability exists in the Exchange Web Services (EWS) endpoint caused by insufficient validation of request content types. An attacker could induce an authenticated user to submit a crafted request, potentially allowing unaut...