CVE-2026-82852 WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in MapSVG = 8.15.0 versions...

CVE-2026-81890 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...

CVE-2026-81890

elFinder (an open-source web file manager built on jQuery UI) prior to 2.1.70 is vulnerable to a CSRF flaw in the netmount command. The command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is never invoked for this state-changing...

GHSA-MFQJ-CQV3-H7XW TYPO3 CMS - Unrestricted File Upload in Form Framework

Problem Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured - uploading PHP files was not possible. The restriction was not enforced server-side because the MimeTypeValidator was registered during form buildi...

TYPO3 CMS - Unrestricted File Upload in Form Framework

Problem Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured - uploading PHP files was not possible. The restriction was not enforced server-side because the MimeTypeValidator was registered during form buildi...

EUVD-2026-43671

TYPO3 CMS - Unrestricted File Upload in Form Framework...

EUVD-2026-68740

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The...

CVE-2026-82905

A server-side request forgery (SSRF) vulnerability exists in sdcb chats versions up to 1.12.0 , specifically in the McpController function within the fetch-tools endpoint (file: src/BE/web/Controllers/Users/Mcps/McpController.cs). The vulnerability is exploitable remotely with low complexity and ...

CVE-2026-82905 sdcb chats fetch-tools Endpoint McpController.cs McpController server-side request forgery

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The...

CVE-2026-53507

oasdiff-action , a GitHub Action that detects breaking changes in OpenAPI specs and posts reviews on pull requests, contained a flaw prior to version 0.0.51 where external $refs in the spec were resolved by default (allow-external-refs: true). On a fork pull request in a public repository, an att...

CVE-2026-82801 NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery

A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-12894 Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-12894

The Qute template engine in Quarkus is vulnerable to server-side template injection (SSTI) via the ReflectionValueResolver component, which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence t...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the FormResubmitSupport resubmission client in support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupport.java. An attacker can make the server initiate an outbound request ...

Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p6gq-j5cr-w38f. This link is maintained to preserve external references. Original Description nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option,...

CVE-2026-82667

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpointurl leads to server-side request forgery. It is possibl...

Security Bulletin: IBM ContextForge MCP Gateway is affected by server-side request forgery in OAuth gateway registration

Summary IBM ContextForge MCP Gateway contains a server-side request forgery SSRF vulnerability in the OAuth gateway registration feature. When a gateway is registered with authtype="oauth" and granttype="clientcredentials", caller-supplied URL fields within oauthconfig including tokenurl,...

CVE-2026-82667

This vulnerability affects yaojingang GEOFlow versions up to 2.1.0 . The server-side request forgery (SSRF) is triggered in the function DistributionController.isValidHttpEndpoint within app/Services/GeoFlow/GenericHttpEndpointResolver.php through manipulation of the endpoint_url argument. The at...

EUVD-2026-68436

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpointurl leads to server-side request forgery. It is possibl...

CVE-2026-82667 yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forgery

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpointurl leads to server-side request forgery. It is possibl...