150116 matches found
CVE-2026-81733 WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php
WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...
CVE-2026-81733
WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...
CVE-2026-81733 WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php
WWBN AVideo through 30.0 and master up to commit 4cb576e contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $REQUEST via a GET...
Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty
Summary There are multiple vulnerabilities in Java, JavaScript and IBM WebSphere Application Server Liberty used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-9320 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server ...
CVE-2026-77701
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...
Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-11806, CVE-2026-11541)
Summary Security Bulletin: There is a vulnerability in IBM WebSphere Application Server Liberty used by IBM Maximo Manage application in IBM Maximo Application Suite Vulnerability Details CVEID:CVE-2026-11806 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is...
CVE-2026-9491
A server-ide request forgery SSRF vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information...
EUVD-2026-67571
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...
CVE-2026-77701
The WCFM Marketplace WordPress plugin (versions before 3.8.2 ) contains a vulnerability where it fails to properly verify ownership of an order when a refund is requested. This flaw allows unauthenticated users to create refund requests against any guest checkout order on the site. Exploitation d...
CVE-2026-77701 WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...
CVE-2026-77701 WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site...
WordPress WCFM Marketplace plugin < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders vulnerability
Unauthenticated Refund Request Creation on Guest Orders vulnerability discovered by Shikhali Jamalzade in WordPress Plugin WCFM Marketplace versions 3.8.2...
EUVD-2026-67344
A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request...
EUVD-2026-67347
WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...
EUVD-2026-67350
A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...
EUVD-2026-67400
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...
CVE-2026-82081
wallabag versions 2 through 2.6.14 are affected by a Server-Side Request Forgery (SSRF) vulnerability caused by a crafted title or content field being mishandled during PDF export . The CVSS 3.1 score is 6.4 (Medium) with a scope change, indicating that exploitation could affect a different secur...
CVE-2026-82081
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...
Security Bulletin: Security Vulnerability in Spring Cloud Affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-41235)
Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability in Spring Cloud Vulnerability Details CVEID:CVE-2025-41235 DESCRIPTION: Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies. CWE:CWE-444:...