32269 matches found
EUVD-2026-69033
Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and...
PT-2026-84253
Name of the Vulnerable Software and Affected Versions Releasit Releasit COD Form & Upsells version 1 Description An issue exists in the OTP Validation component where server-side security is enforced on the client-side. This allows a remote attacker to manipulate the validation process...
PT-2026-84518
Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 Appliances affected versions not specified Description A pre-authentication Server-Side Request Forgery SSRF issue exists in the Work Place interface. This occurs due to an unintended alternate access path, allowing a remote...
PT-2026-84165
Name of the Vulnerable Software and Affected Versions ArmorStart® LT affected versions not specified Description Multiple stored cross-site scripting issues exist. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious...
Linux Distros Unpatched Vulnerability : CVE-2026-82556
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of...
CVE-2026-84110: Client-Side Enforcement of Server-Side Security
A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulation results in client-side enforcement of server-side security. The attack may be launched remotely. The exploit is now public and may be...
CVE-2026-83744: Server-Side Request Forgery (SSRF)
A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forger...
CVE-2026-82957 hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery...
CVE-2026-82957
CVE-2026-82957 is a server-side request forgery (SSRF) in hyperledger-firefly up to version 1.4.0. The flaw resides in the ValidateOptions function within internal/events/webhooks/webhooks.go of the Webhook Subscription component. Manipulating the url argument allows a remote, unauthenticated att...
CVE-2026-77352
Wallos (open-source, self-hostable personal subscription tracker) versions 2.0.0 through before 5.0.0 contain an authenticated SSRF via the per-user SMTP notification host. Any authenticated user (no admin rights required) can set their notification SMTP host to an internal or link-local address....
CVE-2026-77352 Wallos: Authenticated SSRF via per-user SMTP notification host (low-privilege user)
Wallos is an open-source, self-hostable personal subscription tracker. From version 2.0.0 to before version 5.0.0, any authenticated Wallos user no admin rights required can make the server open arbitrary outbound SMTP connections to internal/link-local addresses, by setting the SMTP host of thei...
CVE-2026-77351 Wallos: SSRF via Unvalidated User-Level SMTP Host in Email Notification Settings
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, Wallos lets any authenticated user store an arbitrary SMTP host — including private and cloud-metadata IP addresses — in their personal email notification settings, with no server-side SSRF validation...
CVE-2026-77351
Wallos , an open-source self-hosted personal subscription tracker, is vulnerable to SSRF prior to version 5.0.0 . The root cause is that any authenticated user can store an arbitrary SMTP host—including private and cloud-metadata IP addresses—in their personal email notification settings, with no...
CVE-2026-61638
CVE-2026-61638 affects Wallos , an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6 , the endpoint POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from the request body with no SSRF validation , allowing PHPMailer to connec...
EUVD-2026-68804
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other...
CVE-2026-82852 WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...
CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...
CVE-2026-81890
elFinder (an open-source web file manager built on jQuery UI) prior to 2.1.70 is vulnerable to a CSRF flaw in the netmount command. The command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is never invoked for this state-changing...
TYPO3 CMS - Unrestricted File Upload in Form Framework
Problem Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured - uploading PHP files was not possible. The restriction was not enforced server-side because the MimeTypeValidator was registered during form buildi...