Linux Distros Unpatched Vulnerability : CVE-2026-49236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server-Side Request Forgery SSRF vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This...

nosurf-cve-2025-46721

CVE-2025-46721: CSRF due to non-functional same-origin checks in justinas/nosurf What happened? Am I affected? PoC Patching Acknowledgements What happened? All versions of nosurf before 1.2.0 failed to apply same-origin checks for incoming requests. This happened due to relying on the .URL.Scheme...

DEBIAN-CVE-2026-49236

Server-Side Request Forgery SSRF vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

CVE-2026-49236 Apache XML Graphics Batik: SVG color-profile xml:base bypasses Batik external resource same-origin checks

Server-Side Request Forgery SSRF vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

EUVD-2026-123477

Server-Side Request Forgery SSRF vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

CVE-2026-49236

Server-Side Request Forgery SSRF vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

CVE-2026-49236

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache XML Graphics Batik versions prior to 1.20 . The root cause is that the SVG color-profile xml:base attribute can bypass Batik's external resource same-origin checks . To remediate this issue, users are recommended to upgrade to ve...

CVE-2026-49236: Apache Software Foundation Apache XML Graphics Batik: Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik

Server-Side Request Forgery SSRF vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue...

PT-2026-145229

Name of the Vulnerable Software and Affected Versions Apache XML Graphics Batik versions prior to 1.20 Description Server-Side Request Forgery SSRF occurs when a crafted SVG file uses a malicious xml:base URL to bypass same-origin checks for external resources. This allows the application to make...

SUSE CVE-2026-49458

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitizenode, INPLACE: true accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, documen...

Improper Verification of Source of a Communication Channel

Overview @nuxt/rspack-builder is a rspack bundler for Nuxt Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel through the isSameOriginRequest check in the dev-server request handling path. An attacker can send a browser-originated reques...

CVE-2025-63716

The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery CSRF attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints...

CVE-2025-63716

The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery CSRF attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints...

CVE-2025-63716

The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. The root cause is the application's lack of CSRF protection mechanisms, such as anti-CSRF tokens or same-origin verification , for critical endpoints. This allows an attacker to perform unauthor...

CVE-2025-63716

The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery CSRF attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints...

Exploit for Cross-Site Request Forgery (CSRF) in Nosurf_Project Nosurf

CVE-2025-46721: CSRF...

Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-2960-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2960-1 advisory. An out of bounds write was discovered in Blink. If a user were tricked in to opening a specially crafted website, an attacker could potential...

openSUSE 10 Security Update : seamonkey (seamonkey-3984)

This update fixes several security issues in Mozilla SeaMonkey 1.1.3. Following security problems were fixed : - MFSA 2007-18: Crashes with evidence of memory corruption The usual collection of stability fixes for crashes that look suspicious but haven't been proven to be exploitable. 25 were in...

Unauthorized access to wyciwyg:// documents — Mozilla

Michal Zalewski reported that it was possible to bypass the same-origin checks and read from cached wyciwyg documents. It is possible to access wyciwyg:// documents without proper same domain policy checks through the use of HTTP 302 redirects. This enables the attacker to steal sensitive data...