CVE-2026-66654

MediumCVSS 6.0/10Last modified Oct 24, 2026

Description

Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
TangibleWPVehica Core<= 1.0.104

References

Timeline

Published
Aug 13, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-666557.1Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.CVE-2026-666568.1Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.CVE-2026-666578.1Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.CVE-2026-666588.5Subscriber SQL Injection in Reviewer <= 3.14.2 versions.CVE-2026-666599.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SCVE-2026-66667.5A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE fieCVE-2026-666606.5Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.CVE-2026-666617.7Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.CVE-2026-666629.8Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-666637.1Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.CVE-2026-666647.1Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.CVE-2026-6666510.0Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
CVE-2026-66654: Medium severity, CVSS 6.0 | Vulnix