PT-2026-89848

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

CVE-2026-68526: Cross-Site Request Forgery (CSRF)

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

CVE-2026-62139: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

CVE-2026-49992: Cross-Site Request Forgery (CSRF)

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team,...

CVE-2026-81912: Cross-Site Request Forgery (CSRF)

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

PT-2026-90149

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description Cross-Site Request Forgery CSRF exists in the Move Multiple Groups feature. The endpoint 'dashboard/users/groups/bulkupdate/confirm' allows moving selected group tree nodes without validating an...

CVE-2026-62133: Cross-Site Request Forgery (CSRF)

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

PT-2026-90037

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

CVE-2026-89148: Cross-Site Request Forgery (CSRF)

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a .json.php script, AVideo's automatic CSRF guard autoCSRFGuard/forbidIfIsUntrustedRequest does not run, and when the request includes the sort paramet...

PT-2026-90031

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

PT-2026-90496

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description Cross-Site Request Forgery CSRF occurs in the Express Clear Entries function. The issue exists because the controller records a failed CSRF token check but does not enforce it, allowing...

CVE-2026-81907: Cross-Site Request Forgery (CSRF)

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

WordPress Popup for CF7 with Sweet Alert 1.6.5 Cross Site Request Forgery

WordPress Popup for CF7 with Sweet Alert plugin versions 1.6.5 and below suffer from a cross site request forgery vulnerability. https://packetstorm.news/download/231122...

PT-2026-89841

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a .json.php script, AVideo's automatic CSRF guard autoCSRFGuard/forbidIfIsUntrustedRequest does not run, and when the request includes the sort paramet...

CVE-2026-89245: Cross-Site Request Forgery (CSRF)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

CVE-2026-80380

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery...

CVE-2026-80380 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized actions due to cross-site request forgery...

WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by MYUNGYONG LEE in WordPress Plugin RTMKit versions = 2.1.5...

WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Site Kit by Google versions = 1.186.0...

CVE-2026-84432

Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...