CVE-2026-19075 All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' Parameter

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...

CVE-2026-15229

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...

CVE-2026-15229

The Pinpoint Booking System WordPress plugin (versions through 2.9.9.7.1 ) contains a vulnerability where the booking price is not validated on the server side. This flaw allows unauthenticated users to create bookings at an arbitrary price , such as zero. By selecting a specific payment method, ...

EUVD-2026-55008

The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...

CVE-2026-15229 Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...

CVE-2026-15229 Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...

CVE-2026-14860 Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery

The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...

CVE-2026-14860

The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...

EUVD-2026-55019

The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...

CVE-2026-14860

The Podcast Player WordPress plugin (versions before 8.3.1 ) is vulnerable to an unauthenticated Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate the destination of a server-side request constructed from user-supplied input. This allows an unauthenticated ...

CVE-2026-12971

The LearnPress WordPress plugin (versions prior to 4.4.4 ) is vulnerable to a blind and bounded server-side request forgery (SSRF) . The root cause is a lack of validation for user-supplied URLs before the server attempts to fetch them, specifically within the openai_apply_image_feature functiona...

EUVD-2026-55024

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

CVE-2026-12971

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

CVE-2026-12971 LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

CVE-2026-12971 LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

EUVD-2026-54960

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to...

EUVD-2026-54963

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

CVE-2026-19375

A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...

Governing the KV Cache: Preventing Timing Side-Channel Leakage in Multi-Tenant LLM Inference

The key-value KV cache is the primary throughput optimization in modern large language model LLM inference, enabling prefix reuse across requests. In multi-tenant deployments this cache is shared across tenants, creating a timing side channel: an adversarial tenant can reconstruct another tenant'...

CVE-2026-14860: Server-Side Request Forgery (SSRF)

The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make the server issue requests to arbitrary hosts and read back responses that parse as RSS/XML...