Workflow session email approval process bypass

...

PT-2026-86998

Server-Side Request Forgery SSRF vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09...

ROS-20260908-73-0044

The vulnerability in python-daphne is related to deficiencies in handling HTTP requests. Exploiting this vulnerability allows a remote attacker to send hidden HTTP requests a type of HTTP request smuggling attack...

PT-2026-87060

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...

PT-2026-87116

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users id from $ REQUEST and invokes User::swapUser without calling...

PT-2026-88229

Android’s September 2026 security update fixed 180 issues. The one that stands out is CVE-2026-28662: Wi-Fi related memory corruption that can lead to remote code execution with no user interaction and no additional privileges. Still the class of bug that turns a nearby attacker into a device own...

PT-2026-87401

Server-side request forgery ssrf in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network...

PT-2026-87190

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery SSRF vulnerability in the file upload functionality system/core/uploader.php at lines 509-532. When the "upload from URL" feature follows an HTTP redirect, the redirected...

PT-2026-87120

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge that uses loose comparison == instead of strict comparison === against unset session values. Attackers with only a password can submit an empty request to...

CVE-2026-79577

An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...

CVE-2026-79577

An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request...

EulerOS 2.0 SP12 : nghttp2 (EulerOS-SA-2026-3286)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-3353)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

Cross-site request forgery in the Guardian/CMC login before 26.3.0

Summary A cross-site request forgery vulnerability was discovered in the login functionality both standard and SAML due to missing validation of the anti-CSRF token. Impact An attacker with a valid account can trick a victim into unknowingly authenticating with the attacker's credentials. Any...

NewStart CGSL MAIN 7.02 : libsoup Multiple Vulnerabilities (NS-SA-2026-0100)

The remote NewStart CGSL host, running version MAIN 7.02, has libsoup packages installed that are affected by multiple vulnerabilities: - A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This...

PT-2026-86951

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

PT-2026-87115

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can...

EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-3278)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

PT-2026-87654

Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

EulerOS 2.0 SP12 : perl-HTTP-Tiny (EulerOS-SA-2026-3294)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx...