GHSA-H7PC-VWP9-298G vulnerabilities

Vulnerabilities for packages: openstack-horizon-2026.1, openstack-horizon-2026.1-fips...

Myndr: CORS Misconfiguration / Broken Access Control

A CORS misconfiguration was discovered on the admin panel that allowed any website hosted on a subdomain of the target organization to read authenticated admin responses, including CSRF nonces and session data. This vulnerability could have enabled full admin account takeover through a CSRF attac...

[SECURITY] [DSA 6427-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6427-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 10, 2026 https://www.debian.org/security/faq -...

CVE-2026-72578

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

CVE-2025-32736: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

CVE-2026-72578: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...

CVE-2026-66642: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2...

PT-2026-69443

Name of the Vulnerable Software and Affected Versions WP Umbrella versions 2.24.2 through 2.26.2 Description A Cross-Site Request Forgery CSRF flaw exists in WP Umbrella. This issue allows an attacker to induce a user to perform actions they did not intend to do by tricking them into clicking a...

Joomla 2.9.99.4 - Unauthenticated Remote Code Execution

Exploit Title: Joomla 2.9.99.4 -Unauthenticated Remote Code Execution Date: 2026-07-10 Exploit Author: K3ysTr0K3R Jared Brits Vendor Homepage: https://www.joomla.org/ Software Link: https://extensions.joomla.org/extension/jce/ Version: JCE 1.0.0 through 2.9.99.4 fixed in 2.9.99.5 Tested on: Jooml...

PT-2026-69989

Name of the Vulnerable Software and Affected Versions PingFederate versions prior to 13.1 Description Cross-Site Request Forgery CSRF weaknesses in the Administrative Console may allow actors to perform unauthorized actions. This occurs when administrators with active sessions are triggered to...

PT-2026-69462

Name of the Vulnerable Software and Affected Versions FreePBX Framework version 17.0 Description A cross-site request forgery CSRF issue allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The '/admin/ajax.php' endpoint in amp...

PT-2026-69374

Name of the Vulnerable Software and Affected Versions CheckView versions prior to 2.3.2 Description The plugin fails to restrict its REST API authentication filter to its own routes. It unconditionally discards authentication errors for any request where the URI contains a specific string related...

Splunk Web Deployment Server Arbitrary SPL Command Information Disclosure

The vulnerability of the Deployment Server web interface of the Splunk Web platform for operational analysis in Splunk Enterprise relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary SPL commands and disclose sensitive...

07FLYCMS CSRF

The vulnerability of the 07FLYCMS content management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

FreeBSD : Roundcube -- Multiple vulnerabilities (54d19b85-93d4-11f1-8144-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 54d19b85-93d4-11f1-8144-8447094a420f advisory. The Roundcube project reports: Tenable has extracted the preceding description block directly from the...

CVE-2026-16965

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

CVE-2026-16965 Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

CVE-2026-16965: Cross-Site Request Forgery (CSRF)

The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber and, via CSRF, any logged-in user to update post meta on arbitrary posts and to deactivate the site's active templates...

PT-2026-69264

Name of the Vulnerable Software and Affected Versions Solace Extra versions prior to 1.6.1 Description The Solace Extra WordPress plugin fails to perform capability or nonce checks in an AJAX action. This allows any authenticated user, including those with subscriber privileges, to update post me...

CVE-2026-46409 OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...