CVE-2026-19418

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

Myndr: Myndr CORS Misconfiguration

The CORS configuration on admin.myndr.net allowed any .myndr.net subdomain to read authenticated admin panel responses, including CSRF nonces and session data. This vulnerability could have been exploited to take over admin accounts...

CVE-2026-66775

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

EUVD-2025-210672

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2026-66775 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

CVE-2026-66775

CVE-2026-66775 affects SAP Approuter (SAP Business AI Platform). The vulnerability is a CSRF flaw where cross-site request forgery protection is not enforced on the authentication flow by default. An unauthenticated attacker could craft a malicious link to lure a victim and bind the victim’s sess...

CVE-2026-66775 Multiple vulnerabilities in SAP Business AI Platform (Approuter)

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

EUVD-2026-55887

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

CVE-2026-73162: Cross-Site Request Forgery (CSRF)

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

PT-2026-70102

Name of the Vulnerable Software and Affected Versions MISP cti-transmute affected versions not specified Description Several state-changing account operations are exposed as GET requests, making them susceptible to cross-site request forgery CSRF. CSRF is a flaw where a third-party site induces a...

PT-2026-70047

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description SAP Approuter does not enforce cross-site request forgery CSRF protection on the authentication flow by default. CSRF is a type of attack that tricks a victim into submitting a maliciou...

Joomla JCE 2.9.99.4 Remote Code Execution

The JCE Joomla Content Editor profile import functionality lacks proper authentication and CSRF protections. An unauthenticated attacker can upload a crafted XML file containing PHP code; the file is stored in the /tmp/ directory and can be accessed via HTTP, leading to remote code execution...

PT-2026-70066

Name of the Vulnerable Software and Affected Versions Ray Enterprise Translation versions prior to 1.7.4 Description The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber...

CVE-2026-66775: Cross-Site Request Forgery (CSRF)

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

PT-2026-70078

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 13.0.0 through 13.4.33 TYPO3 CMS versions 14.0.0 through 14.3.5 Description Referrer enforcement became ineffective because the backend and Install Tool applications are served from the site's main entry script rather than a...

CVE-2025-32736

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2025-32736

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2025-32736 PingFederate Administrative Console CSRF weaknesses

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2025-32736

PingFederate Administrative Console is affected by a CSRF vulnerability affecting versions before 13.1. An attacker could trigger unauthorized actions via specially crafted links while an admin has an active session. Underlying issue is CSRF in the Administrative Console; exploitation is indicate...

CVE-2025-32736 PingFederate Administrative Console CSRF weaknesses

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...