CVE-2026-67361 | | | 2026-08-21 | Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file… |
CVE-2026-67358 | | | 2026-08-21 | Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order t… |
CVE-2026-77029 | | | 2026-08-21 | Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66 |
CVE-2026-15046 | Medium | 4.2 | 2026-08-21 | The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authent… |
CVE-2026-77391 | Medium | 4.3 | 2026-08-21 | A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipul… |
CVE-2026-66001 | | | 2026-08-20 | Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and authorize functions in frappe/integrations/oauth2.py allow the… |
CVE-2026-63654 | | | 2026-08-20 | Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frap… |
CVE-2026-64962 | | | 2026-08-20 | ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, when visited by an… |
CVE-2026-28164 | Critical | 9.6 | 2026-08-20 | Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery.
This issue affects Easy Elementor Addon… |
CVE-2026-76610 | | | 2026-08-20 | Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized… |
CVE-2026-14951 | High | 8.0 | 2026-08-20 | An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages. |
CVE-2026-76334 | Medium | 6.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action… |
CVE-2026-63123 | Medium | 6.5 | 2026-08-19 | Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin call… |
CVE-2026-18848 | High | 8.3 | 2026-08-19 | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in… |
CVE-2026-62671 | Medium | 5.4 | 2026-08-19 | Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top… |
CVE-2026-75952 | | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/… |
CVE-2026-40509 | Medium | 4.3 | 2026-08-19 | OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded u… |
CVE-2026-66602 | High | 8.8 | 2026-08-18 | Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery.
This issue affects HashBar… |
CVE-2026-55593 | Medium | 6.5 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in l… |
CVE-2026-68923 | Medium | 6.5 | 2026-08-18 | MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the… |
CVE-2026-67921 | Critical | 9.3 | 2026-08-18 | Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. Th… |
CVE-2026-45129 | Medium | 4.6 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attac… |
CVE-2026-45128 | Low | 3.5 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attack… |
CVE-2026-45127 | Low | 3.5 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attacke… |
CVE-2026-45126 | Low | 3.5 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing… |
CVE-2026-45119 | Medium | 4.6 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-… |
CVE-2026-66635 | High | 7.4 | 2026-08-18 | Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions. |
CVE-2026-75151 | Medium | 4.3 | 2026-08-18 | A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2026-19650 | High | 7.1 | 2026-08-17 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4… |
CVE-2026-74867 | Medium | 4.2 | 2026-08-17 | SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Re… |
CVE-2026-17608 | Medium | 6.5 | 2026-08-16 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin… |
CVE-2026-15384 | Medium | 5.7 | 2026-08-16 | The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops atta… |
CVE-2026-18165 | Medium | 4.2 | 2026-08-15 | @fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE t… |
CVE-2026-67366 | | | 2026-08-14 | Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are cal… |
CVE-2026-73847 | Medium | 6.8 | 2026-08-14 | Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a… |
CVE-2026-57469 | | | 2026-08-14 | Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version… |
CVE-2025-10308 | Medium | 4.3 | 2026-08-14 | The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing n… |
CVE-2026-19786 | Medium | 4.3 | 2026-08-14 | A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulati… |
CVE-2026-72849 | High | 7.7 | 2026-08-13 | Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat ide… |
CVE-2026-72658 | High | 7.3 | 2026-08-13 | Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create vi… |
CVE-2026-17069 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens. |
CVE-2026-13365 | High | 7.1 | 2026-08-13 | IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actio… |
CVE-2026-73482 | High | 8.1 | 2026-08-13 | phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered v… |
CVE-2026-73481 | Medium | 5.4 | 2026-08-13 | phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is perform… |
CVE-2026-73575 | Low | 3.1 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Co… |
CVE-2026-67990 | Medium | 5.4 | 2026-08-13 | basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An un… |
CVE-2025-62318 | Low | 3.7 | 2026-08-13 | HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive inform… |
CVE-2026-19088 | Medium | 5.4 | 2026-08-13 | The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing a… |
CVE-2026-73423 | | | 2026-08-12 | Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the… |
CVE-2026-48551 | High | 7.4 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An att… |
CVE-2026-73292 | High | 8.3 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authe… |
CVE-2026-47232 | Medium | 4.3 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bun… |
CVE-2026-47229 | Medium | 5.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing br… |
CVE-2026-47228 | Medium | 5.2 | 2026-08-12 | Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores… |
CVE-2026-73222 | High | 8.8 | 2026-08-11 | Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option… |
CVE-2026-73162 | | | 2026-08-11 | Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests:
*
/account/follow
*
/account/delete_noti… |
CVE-2026-19418 | | | 2026-08-11 | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend… |
CVE-2026-66775 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious… |
CVE-2025-32736 | | | 2026-08-10 | Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actio… |
CVE-2026-72578 | High | 8.8 | 2026-08-10 | A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on beha… |
CVE-2026-66642 | Medium | 5.4 | 2026-08-10 | Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery.
This issue affects WP Umbrella: from 2.24.2 through 2.26.2. |
CVE-2026-19074 | Medium | 5.3 | 2026-08-10 | The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensiti… |
CVE-2026-16965 | Medium | 4.3 | 2026-08-09 | The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as… |
CVE-2026-46409 | Critical | 9.6 | 2026-08-07 | OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backe… |
CVE-2026-16262 | High | 7.5 | 2026-08-07 | The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthentica… |
CVE-2026-66686 | Medium | 6.5 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions. |
CVE-2026-66681 | Medium | 4.3 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions. |
CVE-2026-28172 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions. |
CVE-2026-70556 | Medium | 4.3 | 2026-08-06 | Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::pos… |
CVE-2025-13394 | Medium | 5.4 | 2026-08-06 | The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically… |
CVE-2026-14313 | Medium | 5.3 | 2026-08-06 | PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), a… |
CVE-2026-14204 | Medium | 6.5 | 2026-08-06 | The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in us… |
CVE-2026-66885 | Medium | 6.5 | 2026-08-05 | Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own… |
CVE-2026-70434 | Medium | 4.2 | 2026-08-05 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL usi… |
CVE-2026-70432 | High | 8.8 | 2026-08-05 | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the… |
CVE-2026-7326 | High | 7.5 | 2026-08-05 | A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenti… |
CVE-2026-71273 | Medium | 6.5 | 2026-08-05 | OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is… |
CVE-2026-60009 | High | 8.8 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The han… |
CVE-2026-7444 | High | 8.1 | 2026-08-05 | The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missi… |
CVE-2026-70376 | Critical | 9.6 | 2026-08-05 | Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action)… |
CVE-2026-17515 | Medium | 4.3 | 2026-08-05 | The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX ac… |
CVE-2026-16613 | Medium | 4.3 | 2026-08-05 | The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no… |
CVE-2026-18819 | Medium | 4.3 | 2026-08-04 | A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The ma… |
CVE-2026-66884 | | | 2026-08-04 | Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.AuthorizationCallback module) allows an attacker to make a victi… |
CVE-2026-69093 | Medium | 4.6 | 2026-08-03 | Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration… |
CVE-2026-69082 | | | 2026-08-03 | CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/<id> endpoint accepte… |
CVE-2026-16292 | Medium | 5.4 | 2026-08-02 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attack… |
CVE-2026-12586 | High | 8.1 | 2026-08-02 | The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce… |
CVE-2026-15988 | High | 8.8 | 2026-08-01 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… |
CVE-2025-14469 | Medium | 4.3 | 2026-08-01 | The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce valid… |
CVE-2026-13729 | Medium | 4.3 | 2026-08-01 | The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing… |
CVE-2026-50986 | High | 8.8 | 2026-07-31 | PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An… |
CVE-2025-67651 | | | 2026-07-31 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attribut… |
CVE-2026-66416 | High | 8.8 | 2026-07-30 | Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authent… |
CVE-2026-44613 | Medium | 6.1 | 2026-07-30 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted te… |
CVE-2026-28813 | High | 8.8 | 2026-07-30 | Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities.
Users are recommended to upgrade to version 2.12.4, which f… |
CVE-2026-5219 | High | 8.3 | 2026-07-30 | Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery.
This issue… |
CVE-2026-5582 | Medium | 4.3 | 2026-07-30 | The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verifi… |
CVE-2026-14239 | High | 7.1 | 2026-07-30 | The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not esc… |
CVE-2026-17936 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestur… |