CVE-2026-59977 ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/id endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/id, the browser sends the user session cookie and the request...