CVE-2026-86806

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue. Patch name: b745f62e29fa37364686525a21eee5e5c0f8a369. It is recommended to upgrade the affected component.

• CWE-918

• https://github.com/opengeos/GeoLibre/
• https://github.com/opengeos/GeoLibre/commit/b745f62e29fa37364686525a21eee5e5c0f8a369
• https://github.com/opengeos/GeoLibre/issues/1573
• https://github.com/opengeos/GeoLibre/pull/1571
• https://github.com/opengeos/GeoLibre/releases/tag/v2.4.0
• https://vuldb.com/cve/CVE-2026-86806
• https://vuldb.com/submit/911055
• https://vuldb.com/vuln/399812
• https://vuldb.com/vuln/399812/cti

Published

Sep 8, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-86800The Hide My WP Ghost WordPress plugin before 7.0.11 does not…5.3
• CVE-2026-86801The To Do List Member WordPress plugin from 1.4 through 1.6 …8.8
• CVE-2026-86802The To Do List Member WordPress plugin through 1.6 does not …3.7
• CVE-2026-86803The The Ocean Extra plugin for WordPress is vulnerable to ar…6.5
• CVE-2026-86804A vulnerability was identified in seakee CPA-Manager-Plus up…5.3
• CVE-2026-86805A time-of-check to time-of-use (TOCTOU) race condition in th…6.3
• CVE-2026-86808A security vulnerability has been detected in moltis-org mol…7.3
• CVE-2026-86809The Persian Elementor WordPress plugin from 2.7.10 before 2.…5.3
• CVE-2026-8681The Essential Chat Support plugin for WordPress is vulnerabl…5.3
• CVE-2026-86810A vulnerability was detected in Open-Web-Analytics up to 1.9…7.3
• CVE-2026-86812The WPCafe WordPress plugin before 3.0.18 does not correctl…6.5
• CVE-2026-86813The MetForm WordPress plugin before 4.1.9 does not properly …4.8