CWE-352 · Cross-Site Request Forgery (CSRF) (page 4)
Page 4 of 98 — CVEs classified under CWE-352, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65488 | High | 7.1 | 2026-07-23 | Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-S… |
CVE-2026-65471 | Critical | 9.6 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions. |
CVE-2026-65464 | Medium | 5.4 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions. |
CVE-2026-65460 | Medium | 4.3 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions. |
CVE-2026-61981 | Medium | 5.4 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions. |
CVE-2026-57785 | High | 8.8 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions. |
CVE-2026-57784 | Critical | 9.6 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions. |
CVE-2026-57626 | High | 7.1 | 2026-07-23 | Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0. |
CVE-2026-24537 | Medium | 4.3 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions. |
CVE-2026-65757 | High | 8.1 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted… |
CVE-2026-64876 | High | 8.8 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token a… |
CVE-2026-64871 | Medium | 5.4 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistent… |
CVE-2026-64791 | High | 8.8 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/upd… |
CVE-2026-63684 | High | 8.8 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extensio… |
CVE-2026-63280 | High | 8.8 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not c… |
CVE-2026-63265 | High | 8.0 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular La… |
CVE-2026-62563 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-62487 | Medium | 6.1 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-62443 | High | 7.1 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected ar… |
CVE-2026-61253 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle HRMS (Japanese) product of Oracle E-Business Suite (component: Oracle Payroll Japanese). Supported versions that are affected are… |
CVE-2026-61217 | Medium | 6.4 | 2026-07-21 | Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: Oracle SSL API). The supported version that is affected is 12.2… |
CVE-2026-61204 | Critical | 9.0 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Program Management product of Oracle PeopleSoft (component: Primavera Integration). The supported version that… |
CVE-2026-61132 | High | 7.6 | 2026-07-21 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is… |
CVE-2026-61101 | High | 8.2 | 2026-07-21 | Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are aff… |
CVE-2026-61097 | Critical | 9.6 | 2026-07-21 | Vulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financial Services Applications (component: Common). Supported versions… |
CVE-2026-61082 | Medium | 6.5 | 2026-07-21 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitab… |
CVE-2026-60962 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 1… |
CVE-2026-60957 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected… |
CVE-2026-60911 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12… |
CVE-2026-60886 | High | 7.6 | 2026-07-21 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2… |
CVE-2026-60842 | Medium | 6.1 | 2026-07-21 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Search). Supported versions that are affected are 12.2.5-12.2… |
CVE-2026-60685 | Medium | 6.1 | 2026-07-21 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2… |
CVE-2026-60664 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60658 | High | 7.5 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60650 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar… |
CVE-2026-60648 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar… |
CVE-2026-60646 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected ar… |
CVE-2026-60643 | High | 8.0 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60642 | High | 7.6 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60640 | High | 8.3 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60639 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60638 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60637 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60636 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60635 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60634 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60633 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-60631 | Critical | 9.3 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1… |
CVE-2026-47000 | Low | 3.5 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security Framework). The supported version that… |
CVE-2026-64821 | Medium | 4.3 | 2026-07-21 | djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase… |
CVE-2026-58482 | Medium | 5.9 | 2026-07-20 | Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is… |
CVE-2026-50743 | Medium | 5.4 | 2026-07-20 | A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered v… |
CVE-2026-32823 | Medium | 4.3 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core p… |
CVE-2026-13156 | Medium | 5.4 | 2026-07-20 | The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action (it verifies the manage_options capability but… |
CVE-2026-16216 | Medium | 4.3 | 2026-07-19 | A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation ca… |
CVE-2026-16081 | Medium | 4.3 | 2026-07-18 | A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a man… |
CVE-2026-9734 | Medium | 4.3 | 2026-07-18 | The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to mis… |
CVE-2026-49215 | Medium | 5.4 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveCom… |
CVE-2026-60025 | High | 8.8 | 2026-07-17 | Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file… |
CVE-2026-62236 | Medium | 5.4 | 2026-07-17 | grav-plugin-login before 3.8.11 contains a cross-site request forgery (CSRF) vulnerability in the login.regenerate2FASecret frontend task, which regenerates an… |
CVE-2026-35143 | Low | 3.0 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated… |
CVE-2026-15005 | High | 8.8 | 2026-07-16 | The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or inco… |
CVE-2026-11866 | Medium | 5.4 | 2026-07-16 | The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request d… |
CVE-2026-12409 | Medium | 4.3 | 2026-07-16 | The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forg… |
CVE-2026-26718 | Critical | 9.1 | 2026-07-15 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modificat… |
CVE-2026-20296 | High | 8.3 | 2026-07-15 | In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, and Splunk Cloud Platform versions below 10.5.2605.0, 10.4.2604.7, 10.3.2512.16, 10.2.2… |
CVE-2026-47158 | High | 8.3 | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter acce… |
CVE-2026-52100 | High | 7.5 | 2026-07-14 | Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPut… |
CVE-2026-15747 | Critical | 9.1 | 2026-07-14 | Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token gener… |
CVE-2026-58476 | High | 8.1 | 2026-07-14 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-… |
CVE-2026-58489 | | 2026-07-13 | HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export flow created an OAuth2 state value bu… | |
CVE-2026-61502 | Medium | 4.3 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attac… |
CVE-2026-61956 | High | 7.1 | 2026-07-13 | Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام – همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issu… |
CVE-2026-57786 | High | 8.8 | 2026-07-13 | Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: fro… |
CVE-2026-15080 | Medium | 4.3 | 2026-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Trans… |
CVE-2026-13243 | Medium | 4.8 | 2026-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request Forgery. This issue affects Salesforce Suite versions: fro… |
CVE-2026-38057 | High | 8.1 | 2026-07-10 | The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authentica… |
CVE-2026-6440 | Medium | 4.3 | 2026-07-10 | The GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up… |
CVE-2026-15070 | High | 8.8 | 2026-07-10 | The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This i… |
CVE-2026-44342 | Medium | 5.3 | 2026-07-09 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account… |
CVE-2026-58143 | High | 8.8 | 2026-07-09 | Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuratio… |
CVE-2026-59148 | High | 8.8 | 2026-07-09 | Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Exp… |
CVE-2026-4275 | High | 8.8 | 2026-07-09 | The Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu… |
CVE-2026-5923 | | 2026-07-08 | Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage. | |
CVE-2026-15034 | Medium | 4.3 | 2026-07-08 | A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulatio… |
CVE-2026-12002 | Medium | 4.7 | 2026-07-08 | The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl… |
CVE-2026-9731 | Medium | 4.3 | 2026-07-08 | The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorr… |
CVE-2026-49471 | High | 8.3 | 2026-07-07 | Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes… |
CVE-2026-58315 | Medium | 4.3 | 2026-07-07 | Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations… |
CVE-2026-34171 | High | 8.0 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoi… |
CVE-2026-59713 | High | 8.1 | 2026-07-06 | Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers… |
CVE-2026-14800 | Medium | 4.3 | 2026-07-06 | A weakness has been identified in imhamzaazam ecommerceFlask up to cb7d9e24c30a99379651b7493b32048126ef402b. The affected element is an unknown function. This… |
CVE-2026-59520 | Medium | 4.3 | 2026-07-05 | Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery. This issue affects CrawlWP SEO: from n/a thro… |
CVE-2026-12746 | High | 8.1 | 2026-07-04 | Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authentication_url method builds the pr… |
CVE-2026-12740 | High | 8.1 | 2026-07-04 | Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirec… |
CVE-2026-14620 | Medium | 4.7 | 2026-07-03 | webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that… |
CVE-2026-57766 | High | 8.8 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions. |
CVE-2026-57761 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions. |
CVE-2026-57759 | High | 8.8 | 2026-07-02 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.Thi… |
CVE-2026-57758 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions. |