CVE-2026-86753 snipe-it before 8.7.0 Business Logic Bypass via asset_model endpoint

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

CVE-2026-86753

snipe-it (asset management application by grokability) versions before 8.7.0 contain a business logic bypass in the POST /account/request/asset_model/{modelId} endpoint. The root cause is a failure to validate the requestable flag for asset models, allowing authenticated users to bypass administr...

EUVD-2026-74930

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/assetmodel/modelId endpoint. Authenticated users can bypass administrative restrictions and create checkout requests for non-requestable asset models by submitting requests directly ...

WordPress Inquiry cart plugin <= 3.4.2 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Inquiry Cart versions = 3.4.2...

CVE-2026-78490

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

ROOT-APP-NPM-GHSA-8X6C-CV3V-VP6G GHSA-8x6c-cv3v-vp6g in cacheable-request - Patched by Root

Root has patched GHSA-8x6c-cv3v-vp6g in the cacheable-request package for Root:npm. Multiple fixed versions available...

CVE-2026-78490

Dell Secure Connect Gateway (SCG) 5.0 contains an Improper Restriction of Excessive Authentication Attempts vulnerability in both the Appliance (versions prior to 5.36.00.16) and Application (versions prior to 5.36.00.00) editions. An unauthenticated attacker with network access could exploit thi...

EUVD-2026-74850

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

CVE-2026-78490

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading ...

CVE-2026-87821

Lara Dashboard versions 0.9.2 through 1.3.1 are affected by a Server-Side Request Forgery (SSRF) in the POST /api/admin/builder/markdown/fetch endpoint. Any authenticated user can supply a malicious URL without host validation or redirect restrictions , allowing them to read the response body of ...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-87821 Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IA...

CVE-2026-79635

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery SSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access...

CVE-2026-79635

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access can exploit it to gain unauthorized access . The vulnerability is rated CVSS 7.3 (High) with low impact on confidentiality, in...

CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery

Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...

CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery

Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...

CVE-2026-54048 Apache Impala: Avro Schema URL Server-Side Request Forgery

Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...

CVE-2026-54048

Apache Impala versions 2.0.0 through 4.5.1 are vulnerable to a Server-Side Request Forgery (SSRF) . The flaw exists because specifying tblproperties('avro.schema.url'=' http://...') or a file:/// URI on a table allows an attacker to trigger a GET request to internal endpoints that the Impala serv...

CVE-2026-54048

Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...

CVE-2026-19733

Server-Side request forgery SSRF vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Server Side Request Forgery. This issue affects Library Information and Document Automati...