CVE-2026-84649

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

CVE-2026-8151

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

EUVD-2026-61222

fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count...

EUVD-2026-68772

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections...

GHSA-9HJF-W35W-6VX2 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...

Cross-site Request Forgery (CSRF)

Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the netmount process. An attacker can force the application to mount an attacker-controlled FTP endpoin...

EUVD-2026-70043

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

CVE-2026-8151 Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

CVE-2026-8151

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 lacks CSRF protection on its settings page. An attacker can craft a request that, when submitted by a logged-in administrator , silently replaces the configured MailChimp API key. Once swapped, all subsequent member registr...

CVE-2026-84759

Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...

CVE-2026-84764

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

CVE-2026-84770

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

CVE-2026-66652

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...

Malicious code in ariel-octans-csrf-superagent (npm)

Source: amazon-inspector 7ad782e8410ebf0acd6ca7e645af374b1c97296fe8279c828a59984a30eb1e2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in arcturus-ignite-csrf-janus (npm)

Source: amazon-inspector 30e3b9ed32ae320ad1acddea3e3a6cbb09e432ca21542a11792b20e4b4eb6fdf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in archaeogenetics-csrf-aquarius-perturbation (npm)

Source: amazon-inspector f3bf298157c040760bce94b452e888389305beacf18b29f6f82b92ab32890e45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in aquarius-perseus-cross-env-csrf (npm)

Source: amazon-inspector 767e564cf10b29d0cc24f9c957f3a9d251f91d74dd9ef05e0ca75c1d4901752b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in apollo-non-blocking-local-csrf (npm)

Source: amazon-inspector 219dba9aaf9a81b49e9c15c99ed9480e9146ffc8e9759ebfa7376db6a1c7b1f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antares-csrf-ignite-bunyan (npm)

Source: amazon-inspector acfd3b91a49b333d4e3b551e825ad73ebabb48af5696ee496404e652d6a1ee9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...