CVE-2026-85612

CVE-2026-85612 CVE-2026-85612 - OpenPanel Unauthenticated Server-Side Request Forgery SSRF Advisory For full technical details, PoC, affected versions, impact, and remediation: https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-2hff-m67f-2w2w Discoverer Abdul Wassay hotplugin0x01...

CVE-2026-100379 Cross-request disclosure of CentralAuth cookies in Wikipedia Android App

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main...

CVE-2026-100379 Cross-request disclosure of CentralAuth cookies in Wikipedia Android App

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main...

CVE-2026-100373

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

EUVD-2026-87328

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100391

MediaFlow Proxy versions through 2.4.9 are vulnerable to a server-side request forgery (SSRF) in the /proxy routes. The root cause is missing and incomplete destination validation in the d query parameter. This allows remote attackers to supply arbitrary internal URLs, including loopback addresse...

CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100391 MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full...

CVE-2026-100373

OpenMetadata versions through 2.0.2 are vulnerable to a server-side request forgery (SSRF) vulnerability within the URLValidator.validateURL function. The root cause is a failure to properly resolve DNS hostnames and validate internal addresses. Specifically, users with permissions to create or u...

EUVD-2026-87316

OpenMetadata through 2.0.2 contains a server-side request forgery vulnerability in the URLValidator.validateURL function that fails to properly resolve DNS hostnames and validate internal addresses. Users permitted to create or update EventSubscription can set webhook destinations to internal...

CVE-2026-56734

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-56732

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating...

EUVD-2026-87219

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HTML elements into ticket bodies. When another user views the crafted ticket, the injected element can trigger a logout request, terminating...

CVE-2026-56732

Prior to version 7.0.2 , the Zammad open source helpdesk system is vulnerable to an HTML sanitization flaw. This allows an attacker to inject specific HTML elements into ticket bodies . When another user views the crafted ticket, the injected element triggers a logout request , resulting in the t...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-56734 Zammad: Avatar Image URL Server-Side Request Forwarding

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, during federated authentication OAuth/OIDC/SAML, a profile image URL from the external identity provider is fetched without verifying the target address. An actor who controls their profile at a connected provider...

CVE-2026-49850 InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

CVE-2026-85289

The open-source application InvoicePlane (prior to version 1.7.2) is vulnerable to Cross-Site Request Forgery (CSRF) due to missing CSRF token validation on specific delete methods. Specifically, the Payments::delete(), Recurring::delete(), and User_clients::delete() functions omit the ensure_val...

CVE-2026-85274 InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests...

CVE-2026-85274 InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests...