CVE-2026-62322 | Medium | 6.5 | 2026-10-15 | Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the r… |
CVE-2026-89279 | Medium | 6.5 | 2026-10-13 | Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing.
This issue affects authtake: from v1.3 b… |
CVE-2026-103076 | Medium | 5.4 | 2026-10-13 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Reg… |
CVE-2026-84312 | High | 7.1 | 2026-10-12 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state… |
CVE-2026-54459 | Medium | 4.3 | 2026-10-12 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the… |
CVE-2022-51020 | Medium | 5.9 | 2026-10-12 | Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. A… |
CVE-2026-59977 | High | 8.1 | 2026-10-12 | ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF protection. If… |
CVE-2026-108481 | High | 7.4 | 2026-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordP… |
CVE-2026-108479 | High | 8.1 | 2026-10-12 | Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordP… |
CVE-2026-85960 | High | 7.5 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker who lures… |
CVE-2026-108909 | Medium | 4.3 | 2026-10-12 | A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing… |
CVE-2026-78358 | Medium | 4.3 | 2026-10-12 | Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In particular, the DBUpdat… |
CVE-2026-48211 | Medium | 5.4 | 2026-10-12 | An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS Adm… |
CVE-2026-84166 | Medium | 4.3 | 2026-10-12 | The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a… |
CVE-2026-108800 | Medium | 4.3 | 2026-10-12 | A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery… |
CVE-2026-108738 | Medium | 4.2 | 2026-10-11 | Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because t… |
CVE-2026-108553 | High | 7.5 | 2026-10-10 | OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expr… |
CVE-2026-107848 | Low | 3.5 | 2026-10-09 | Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declar… |
CVE-2026-107809 | High | 8.8 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential aft… |
CVE-2026-62026 | High | 7.1 | 2026-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard… |
CVE-2026-85348 | Medium | 4.3 | 2026-10-09 | The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that se… |
CVE-2026-96671 | High | 8.8 | 2026-10-09 | Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affect… |
CVE-2026-107831 | Medium | 4.3 | 2026-10-08 | Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoint… |
CVE-2026-78388 | Medium | 4.3 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery which could all… |
CVE-2026-107337 | High | 7.1 | 2026-10-08 | The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force… |
CVE-2026-107295 | High | 7.6 | 2026-10-08 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() an… |
CVE-2026-66479 | High | 7.1 | 2026-10-08 | Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a throu… |
CVE-2026-62142 | High | 8.8 | 2026-10-08 | Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0. |
CVE-2026-106611 | High | 7.1 | 2026-10-08 | Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a thr… |
CVE-2026-102784 | | | 2026-10-08 | Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session toke… |
CVE-2026-105260 | Medium | 4.3 | 2026-10-08 | The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capa… |
CVE-2025-70522 | High | 8.8 | 2026-10-07 | The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed ag… |
CVE-2025-70517 | High | 8.8 | 2026-10-07 | The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed ag… |
CVE-2026-45161 | Medium | 5.4 | 2026-10-07 | wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` view in wger accepts GET requests and executes `django_login… |
CVE-2026-106216 | Medium | 5.4 | 2026-10-06 | Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypa… |
CVE-2026-105706 | Medium | 4.3 | 2026-10-06 | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-si… |
CVE-2026-105783 | High | 8.0 | 2026-10-06 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with… |
CVE-2026-102778 | Medium | 6.1 | 2026-10-05 | Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image l… |
CVE-2026-102776 | Medium | 4.3 | 2026-10-05 | Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons o… |
CVE-2026-104407 | High | 7.1 | 2026-10-05 | Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects Pow… |
CVE-2026-105292 | Medium | 5.9 | 2026-10-05 | Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callba… |
CVE-2026-93549 | High | 8.8 | 2026-10-04 | The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce pr… |
CVE-2026-39718 | High | 8.8 | 2026-10-02 | Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a thro… |
CVE-2026-104453 | Medium | 5.4 | 2026-10-02 | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring admi… |
CVE-2026-104452 | Medium | 5.4 | 2026-10-02 | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests withou… |
CVE-2026-104451 | Medium | 4.3 | 2026-10-02 | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET re… |
CVE-2026-104448 | High | 8.1 | 2026-10-02 | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request car… |
CVE-2026-104447 | High | 7.1 | 2026-10-02 | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via… |
CVE-2026-56662 | Critical | 9.6 | 2026-10-01 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form c… |
CVE-2026-56660 | Critical | 9.1 | 2026-10-01 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in Upda… |
CVE-2026-104059 | High | 8.1 | 2026-10-01 | Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform stat… |
CVE-2026-103067 | High | 8.0 | 2026-10-01 | Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Me… |
CVE-2026-94220 | | | 2026-10-01 | Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX.
An attacker who can get a user to click a crafted… |
CVE-2026-103285 | Medium | 4.3 | 2026-10-01 | Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit… |
CVE-2026-64947 | | | 2026-10-01 | A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, result… |
CVE-2026-64946 | | | 2026-10-01 | A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltrati… |
CVE-2026-34190 | | | 2026-10-01 | Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated a… |
CVE-2026-34189 | | | 2026-10-01 | Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator vi… |
CVE-2026-101147 | High | 8.8 | 2026-10-01 | The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce… |
CVE-2026-97299 | Medium | 5.4 | 2026-09-30 | Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions. |
CVE-2026-96838 | High | 8.8 | 2026-09-30 | Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 versions. |
CVE-2026-102399 | Medium | 5.4 | 2026-09-30 | Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions. |
CVE-2026-67993 | High | 8.8 | 2026-09-29 | basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback. |
CVE-2026-95362 | High | 8.8 | 2026-09-29 | Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin pol… |
CVE-2026-73597 | Medium | 6.5 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated… |
CVE-2026-41875 | | | 2026-09-29 | Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, wi… |
CVE-2026-101093 | Medium | 5.4 | 2026-09-28 | Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verifica… |
CVE-2026-82380 | High | 8.1 | 2026-09-28 | Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim'… |
CVE-2026-100873 | Medium | 4.3 | 2026-09-27 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown func… |
CVE-2026-100749 | | | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are… |
CVE-2026-100748 | | | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 |
CVE-2026-100747 | | | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload… |
CVE-2026-100712 | Medium | 6.5 | 2026-09-26 | froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g… |
CVE-2026-96524 | High | 8.8 | 2026-09-26 | The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a con… |
CVE-2026-100524 | Medium | 5.4 | 2026-09-26 | Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions wit… |
CVE-2026-86066 | | | 2026-09-25 | Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_v… |
CVE-2026-84463 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video… |
CVE-2026-56732 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HT… |
CVE-2026-85289 | Medium | 6.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensure_valid_post_reques… |
CVE-2026-85274 | Medium | 6.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a… |
CVE-2026-62062 | High | 8.8 | 2026-09-25 | Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery.
This issue affects Elementor Website Builder… |
CVE-2026-97648 | Medium | 4.3 | 2026-09-25 | A vulnerability was detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function. Performin… |
CVE-2026-57177 | Medium | 4.3 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the a… |
CVE-2026-96551 | Medium | 4.3 | 2026-09-23 | A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/m… |
CVE-2026-94487 | High | 8.1 | 2026-09-23 | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions. |
CVE-2026-90905 | | | 2026-09-23 | Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrat… |
CVE-2026-90903 | | | 2026-09-23 | Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administr… |
CVE-2026-90900 | | | 2026-09-23 | Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product r… |
CVE-2026-63000 | Medium | 6.4 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php in… |
CVE-2026-88418 | High | 8.8 | 2026-09-22 | CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not… |
CVE-2026-75743 | High | 7.1 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker… |
CVE-2026-95658 | | | 2026-09-22 | MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unloc… |
CVE-2026-63373 | Medium | 4.2 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/Ab… |
CVE-2026-61687 | High | 7.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state… |
CVE-2026-94404 | | | 2026-09-21 | MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving t… |
CVE-2026-92410 | Medium | 4.3 | 2026-09-20 | The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to del… |
CVE-2026-93873 | Medium | 4.3 | 2026-09-18 | Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-sub… |
CVE-2026-93870 | Medium | 4.3 | 2026-09-18 | Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated use… |
CVE-2026-84084 | High | 8.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery (CSRF) vulnerability. |
CVE-2026-84077 | High | 8.1 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability. |