PT-2026-71143

Name of the Vulnerable Software and Affected Versions Semaphore UI versions prior to 2.18.21 Description The application lacks Cross-Site Request Forgery CSRF protection—a type of attack that tricks a victim into submitting a malicious request—and does not require current-password confirmation at...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a cross-site request forgery (CVE-2026-14980, CVE-2026-2482)

Summary IBM WebSphere Application Server Liberty is affected by a cross-site request forgery vulnerability with the collectiveController-1.0 enabled. Vulnerability Details CVEID:CVE-2026-14980 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to...

CVE-2026-72778

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778

Summary: CVE-2026-72778 affects Craft CMS 4.x (from 4.0.0-RC1 up to 4.18.2) and 5.x (from 5.0.0-RC1 up to 5.10.6). The vulnerability is an authenticated remote code execution in the control panel element-search condition handling. The root cause is that Condition::createCondition() decodes and me...

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

EUVD-2026-56102

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-73162

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

Origin Validation Error

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Origin Validation Error via referrer enforcement in the ReferrerEnforcer code used by the backend and Install Tool. An attacker can invoke protected backend or...

CVE-2026-73162

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

CVE-2026-73162 cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

EUVD-2026-55994

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

CVE-2026-73162 cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

CVE-2026-73162

CVE-2026-73162 affects MISP cti-transmute where several state-changing endpoints were exposed as unauthenticated GET requests: /account/follow, /account/delete_notification, /account/mark_notification_read, and /account/mark_all_read. The underlying issue is CSRF risk because these authenticated ...

CVE-2026-73162 cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

CVE-2026-73162

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

CVE-2026-19418

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...