CVE-2026-106216 | | | 2026-10-06 | Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypa… |
CVE-2026-105706 | Medium | 4.3 | 2026-10-06 | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-si… |
CVE-2026-105783 | High | 8.0 | 2026-10-06 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with… |
CVE-2026-102778 | | | 2026-10-05 | Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0 - The page a shared image l… |
CVE-2026-102776 | | | 2026-10-05 | Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0 - Eight tasks which the buttons o… |
CVE-2026-104407 | High | 7.1 | 2026-10-05 | Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects Pow… |
CVE-2026-105292 | Medium | 5.9 | 2026-10-05 | Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callba… |
CVE-2026-93549 | High | 8.8 | 2026-10-04 | The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce pr… |
CVE-2026-39718 | High | 8.8 | 2026-10-02 | Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a thro… |
CVE-2026-104453 | Medium | 5.4 | 2026-10-02 | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring admi… |
CVE-2026-104452 | Medium | 5.4 | 2026-10-02 | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests withou… |
CVE-2026-104451 | Medium | 4.3 | 2026-10-02 | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET re… |
CVE-2026-104448 | High | 8.1 | 2026-10-02 | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request car… |
CVE-2026-104447 | High | 7.1 | 2026-10-02 | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via… |
CVE-2026-56662 | Critical | 9.6 | 2026-10-01 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form c… |
CVE-2026-56660 | Critical | 9.1 | 2026-10-01 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in Upda… |
CVE-2026-104059 | High | 8.1 | 2026-10-01 | Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform stat… |
CVE-2026-103067 | High | 8.0 | 2026-10-01 | Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Me… |
CVE-2026-94220 | | | 2026-10-01 | Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX.
An attacker who can get a user to click a crafted… |
CVE-2026-103285 | Medium | 4.3 | 2026-10-01 | Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows attackers to submit… |
CVE-2026-64947 | | | 2026-10-01 | A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, result… |
CVE-2026-64946 | | | 2026-10-01 | A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltrati… |
CVE-2026-34190 | | | 2026-10-01 | Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated a… |
CVE-2026-34189 | | | 2026-10-01 | Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator vi… |
CVE-2026-101147 | High | 8.8 | 2026-10-01 | The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce… |
CVE-2026-97299 | Medium | 5.4 | 2026-09-30 | Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions. |
CVE-2026-96838 | High | 8.8 | 2026-09-30 | Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 versions. |
CVE-2026-102399 | Medium | 5.4 | 2026-09-30 | Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions. |
CVE-2026-67993 | High | 8.8 | 2026-09-29 | basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback. |
CVE-2026-95362 | High | 8.8 | 2026-09-29 | Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin pol… |
CVE-2026-73597 | Medium | 6.5 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated… |
CVE-2026-41875 | | | 2026-09-29 | Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, wi… |
CVE-2026-101093 | Medium | 5.4 | 2026-09-28 | Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verifica… |
CVE-2026-82380 | High | 8.1 | 2026-09-28 | Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim'… |
CVE-2026-100873 | Medium | 4.3 | 2026-09-27 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown func… |
CVE-2026-100749 | | | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are… |
CVE-2026-100748 | | | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 |
CVE-2026-100747 | | | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload… |
CVE-2026-100712 | Medium | 6.5 | 2026-09-26 | froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management page (e.g… |
CVE-2026-96524 | High | 8.8 | 2026-09-26 | The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a con… |
CVE-2026-100524 | Medium | 5.4 | 2026-09-26 | Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions wit… |
CVE-2026-86066 | | | 2026-09-25 | Horilla is an HR and CRM software. Prior to 2.0.0, approve_validate_attendance_request at /attendance/approve-validate-attendance-request/ changes attendance_v… |
CVE-2026-84463 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video… |
CVE-2026-56732 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HT… |
CVE-2026-85289 | Medium | 6.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensure_valid_post_reques… |
CVE-2026-85274 | Medium | 6.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop() as a… |
CVE-2026-62062 | High | 8.8 | 2026-09-25 | Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery.
This issue affects Elementor Website Builder… |
CVE-2026-97648 | Medium | 4.3 | 2026-09-25 | A vulnerability was detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function. Performin… |
CVE-2026-57177 | Medium | 4.3 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the a… |
CVE-2026-96551 | Medium | 4.3 | 2026-09-23 | A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/m… |
CVE-2026-94487 | High | 8.1 | 2026-09-23 | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions. |
CVE-2026-90905 | | | 2026-09-23 | Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrat… |
CVE-2026-90903 | | | 2026-09-23 | Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administr… |
CVE-2026-90900 | | | 2026-09-23 | Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product r… |
CVE-2026-63000 | Medium | 6.4 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php in… |
CVE-2026-88418 | High | 8.8 | 2026-09-22 | CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not… |
CVE-2026-75743 | High | 7.1 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in a Security feature bypass. An attacker… |
CVE-2026-95658 | | | 2026-09-22 | MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unloc… |
CVE-2026-63373 | Medium | 4.2 | 2026-09-21 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/Ab… |
CVE-2026-61687 | High | 7.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state… |
CVE-2026-94404 | | | 2026-09-21 | MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving t… |
CVE-2026-92410 | Medium | 4.3 | 2026-09-20 | The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to del… |
CVE-2026-93873 | Medium | 4.3 | 2026-09-18 | Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-sub… |
CVE-2026-93870 | Medium | 4.3 | 2026-09-18 | Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf of authenticated use… |
CVE-2026-84084 | High | 8.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery (CSRF) vulnerability. |
CVE-2026-84077 | High | 8.1 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability. |
CVE-2026-93531 | Medium | 4.3 | 2026-09-18 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This… |
CVE-2025-15399 | Critical | 10.0 | 2026-09-18 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could all… |
CVE-2026-93456 | High | 8.2 | 2026-09-18 | django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify… |
CVE-2026-54642 | | | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action in admin/sources/or… |
CVE-2026-54510 | High | 7.1 | 2026-09-17 | Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrf_exempt_for_api_tokens() before_re… |
CVE-2026-80355 | Medium | 5.4 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with… |
CVE-2026-78295 | High | 8.8 | 2026-09-17 | Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions. |
CVE-2026-74005 | Medium | 5.4 | 2026-09-17 | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions. |
CVE-2026-66571 | High | 7.1 | 2026-09-17 | Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions. |
CVE-2026-91009 | Medium | 4.3 | 2026-09-17 | The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actio… |
CVE-2026-92582 | High | 7.1 | 2026-09-16 | AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF… |
CVE-2026-92806 | High | 8.1 | 2026-09-16 | phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in a… |
CVE-2026-92751 | High | 8.1 | 2026-09-16 | CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated oper… |
CVE-2026-61593 | High | 8.1 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server PO… |
CVE-2026-92383 | Medium | 4.3 | 2026-09-16 | A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the fil… |
CVE-2026-19535 | | | 2026-09-16 | Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advantech EKI-1242IEIMS… |
CVE-2026-40857 | | | 2026-09-16 | WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validat… |
CVE-2026-85131 | Medium | 6.5 | 2026-09-16 | The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, a… |
CVE-2026-76856 | High | 8.1 | 2026-09-15 | Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_c… |
CVE-2026-87132 | High | 7.6 | 2026-09-15 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is… |
CVE-2026-83126 | High | 7.6 | 2026-09-15 | Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-… |
CVE-2026-18425 | Low | 2.7 | 2026-09-15 | Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_… |
CVE-2026-81924 | Medium | 6.5 | 2026-09-15 | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect control… |
CVE-2026-81920 | Medium | 4.3 | 2026-09-15 | Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the admin… |
CVE-2026-81919 | Medium | 4.3 | 2026-09-15 | Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Pag… |
CVE-2026-78081 | | | 2026-09-15 | Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A f… |
CVE-2026-68532 | | | 2026-09-15 | Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote una… |
CVE-2026-81897 | Medium | 5.4 | 2026-09-15 | In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF token. By causing an… |
CVE-2026-52823 | | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/rest… |
CVE-2026-91857 | | | 2026-09-15 | Affected versions of MISP expose several state-changing controller actions without restricting them to POST.
The affected actions are:
- EventReportsCont… |
CVE-2026-91819 | | | 2026-09-15 | Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation.
CakePHP honors a _me… |
CVE-2026-81902 | High | 8.1 | 2026-09-14 | Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a r… |
CVE-2026-17047 | Medium | 5.4 | 2026-09-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation. |
CVE-2026-90893 | | | 2026-09-14 | MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle we… |