CWE-352 · Cross-Site Request Forgery (CSRF) (page 3)
Page 3 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40509 | Medium | 4.3 | 2026-08-19 | OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter in the DICOM viewer page is embedded u… |
CVE-2026-71694 | High | 8.8 | 2026-08-19 | An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arb… |
CVE-2026-66602 | High | 8.8 | 2026-08-18 | Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar… |
CVE-2026-71123 | Medium | 5.4 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25… |
CVE-2026-55593 | Medium | 6.5 | 2026-08-18 | Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in l… |
CVE-2026-68923 | Medium | 6.5 | 2026-08-18 | MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the… |
CVE-2026-67921 | Critical | 9.3 | 2026-08-18 | Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. Th… |
CVE-2026-45129 | Medium | 4.6 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attac… |
CVE-2026-45128 | Low | 3.5 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attack… |
CVE-2026-45127 | Low | 3.5 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attacke… |
CVE-2026-45126 | Low | 3.5 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing… |
CVE-2026-45119 | Medium | 4.6 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-… |
CVE-2026-66635 | High | 7.4 | 2026-08-18 | Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n… |
CVE-2026-75151 | Medium | 4.3 | 2026-08-18 | A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2026-19650 | High | 7.1 | 2026-08-17 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4… |
CVE-2026-74867 | Medium | 4.2 | 2026-08-17 | SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Re… |
CVE-2026-17608 | Medium | 6.5 | 2026-08-16 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin… |
CVE-2026-15384 | Medium | 5.7 | 2026-08-16 | The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops atta… |
CVE-2026-18165 | Medium | 4.2 | 2026-08-15 | @fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE t… |
CVE-2026-67366 | | 2026-08-14 | Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are cal… | |
CVE-2026-73847 | Medium | 6.8 | 2026-08-14 | Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant execute_tool action in admin/ai.php lets a… |
CVE-2026-57469 | | 2026-08-14 | Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version… | |
CVE-2025-10308 | Medium | 4.3 | 2026-08-14 | The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing n… |
CVE-2026-19786 | Medium | 4.3 | 2026-08-14 | A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulati… |
CVE-2026-72849 | High | 7.7 | 2026-08-13 | Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat ide… |
CVE-2026-72658 | High | 7.3 | 2026-08-13 | Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create vi… |
CVE-2026-17069 | High | 8.1 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens. |
CVE-2026-13365 | High | 7.1 | 2026-08-13 | IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actio… |
CVE-2026-73482 | High | 8.1 | 2026-08-13 | phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered v… |
CVE-2026-73481 | Medium | 5.4 | 2026-08-13 | phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is perform… |
CVE-2026-73575 | Low | 3.1 | 2026-08-13 | In Zimbra Collaboration (ZCS) before 10.1.17, a Cross-Site Request Forgery (CSRF) vulnerability exists in the Exchange Web Services (EWS) endpoint of Zimbra Co… |
CVE-2026-67990 | Medium | 5.4 | 2026-08-13 | basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An un… |
CVE-2025-62318 | Low | 3.7 | 2026-08-13 | HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive inform… |
CVE-2026-19088 | Medium | 5.4 | 2026-08-13 | The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin before 4.9.3 does not protect one of its authentication endpoints against CSRF, allowing a… |
CVE-2026-73423 | | 2026-08-12 | Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/hono pipeline installs security.checkOrigin only through the… | |
CVE-2026-48551 | High | 7.4 | 2026-08-12 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An att… |
CVE-2026-73292 | High | 8.3 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authe… |
CVE-2026-47232 | Medium | 4.3 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bun… |
CVE-2026-47229 | Medium | 5.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing br… |
CVE-2026-47228 | Medium | 5.2 | 2026-08-12 | Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores… |
CVE-2026-73222 | High | 8.8 | 2026-08-11 | Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option… |
CVE-2026-73162 | | 2026-08-11 | Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_noti… | |
CVE-2026-19418 | | 2026-08-11 | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend… | |
CVE-2026-66775 | Medium | 4.3 | 2026-08-11 | SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious… |
CVE-2025-32736 | | 2026-08-10 | Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actio… | |
CVE-2026-72578 | High | 8.8 | 2026-08-10 | A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on beha… |
CVE-2026-66642 | Medium | 5.4 | 2026-08-10 | Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2. |
CVE-2026-19074 | Medium | 5.3 | 2026-08-10 | The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 (<= 3.4.2) is vulnerable to unauthenticated sensiti… |
CVE-2026-16965 | Medium | 4.3 | 2026-08-09 | The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as… |
CVE-2026-46409 | Critical | 9.6 | 2026-08-07 | OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backe… |
CVE-2026-16262 | High | 7.5 | 2026-08-07 | The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthentica… |
CVE-2026-66686 | Medium | 6.5 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions. |
CVE-2026-66681 | Medium | 4.3 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions. |
CVE-2026-28172 | High | 7.1 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions. |
CVE-2026-70556 | Medium | 4.3 | 2026-08-06 | Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::pos… |
CVE-2025-13394 | Medium | 5.4 | 2026-08-06 | The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically… |
CVE-2026-14313 | Medium | 5.3 | 2026-08-06 | PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), a… |
CVE-2026-14204 | Medium | 6.5 | 2026-08-06 | The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in us… |
CVE-2026-66885 | Medium | 6.5 | 2026-08-05 | Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own… |
CVE-2026-70434 | Medium | 4.2 | 2026-08-05 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL usi… |
CVE-2026-70432 | High | 8.8 | 2026-08-05 | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the… |
CVE-2026-7326 | High | 7.5 | 2026-08-05 | A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenti… |
CVE-2026-71273 | Medium | 6.5 | 2026-08-05 | OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is… |
CVE-2026-60009 | High | 8.8 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The han… |
CVE-2026-7444 | High | 8.1 | 2026-08-05 | The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missi… |
CVE-2026-70376 | Critical | 9.6 | 2026-08-05 | Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action)… |
CVE-2026-17515 | Medium | 4.3 | 2026-08-05 | The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX ac… |
CVE-2026-16613 | Medium | 4.3 | 2026-08-05 | The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no… |
CVE-2026-18819 | Medium | 4.3 | 2026-08-04 | A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The ma… |
CVE-2026-66884 | | 2026-08-04 | Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.AuthorizationCallback module) allows an attacker to make a victi… | |
CVE-2026-69093 | Medium | 4.6 | 2026-08-03 | Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration… |
CVE-2026-69082 | | 2026-08-03 | CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/<id> endpoint accepte… | |
CVE-2026-16292 | Medium | 5.4 | 2026-08-02 | The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attack… |
CVE-2026-12586 | High | 8.1 | 2026-08-02 | The Lenxel WP WordPress theme through 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce… |
CVE-2026-15988 | High | 8.8 | 2026-08-01 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… |
CVE-2025-14469 | Medium | 4.3 | 2026-08-01 | The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce valid… |
CVE-2026-13729 | Medium | 4.3 | 2026-08-01 | The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing… |
CVE-2026-50986 | High | 8.8 | 2026-07-31 | PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An… |
CVE-2025-67651 | | 2026-07-31 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attribut… | |
CVE-2026-66416 | High | 8.8 | 2026-07-30 | Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authent… |
CVE-2026-44613 | Medium | 6.1 | 2026-07-30 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted te… |
CVE-2026-28813 | High | 8.8 | 2026-07-30 | Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which f… |
CVE-2026-5219 | High | 8.3 | 2026-07-30 | Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue… |
CVE-2026-5582 | Medium | 4.3 | 2026-07-30 | The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verifi… |
CVE-2026-14239 | High | 7.1 | 2026-07-30 | The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not esc… |
CVE-2026-17936 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2026-2482 | Low | 3.1 | 2026-07-29 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malic… |
CVE-2026-65947 | High | 7.3 | 2026-07-29 | Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2 |
CVE-2026-65944 | High | 8.8 | 2026-07-29 | Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0 |
CVE-2026-9720 | Medium | 4.3 | 2026-07-29 | The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is du… |
CVE-2026-14234 | High | 7.1 | 2026-07-29 | The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick… |
CVE-2026-47725 | | 2026-07-28 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/* POST / PUT / PATCH / DELETE route… | |
CVE-2026-15136 | Medium | 4.3 | 2026-07-28 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2026-66474 | Medium | 4.3 | 2026-07-27 | Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions. |
CVE-2026-66428 | Medium | 4.3 | 2026-07-27 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions. |
CVE-2026-15212 | High | 8.8 | 2026-07-23 | The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::ve… |
CVE-2026-65540 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions. |
CVE-2026-65539 | High | 7.1 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions. |
CVE-2026-65536 | Medium | 6.5 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions. |
CVE-2026-65512 | Medium | 5.4 | 2026-07-23 | Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This iss… |