CVE-2026-16262

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

CVE-2026-16262 Estatik < 4.3.3 - Login CSRF

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

CVE-2026-16262

The Estatik Real Estate Plugin for WordPress, in versions before 4.3.3 , is vulnerable to a Login CSRF attack. The root cause is that the plugin fails to bind its OAuth social login flow to the initiating user session. This allows an unauthenticated attacker to trick a victim into logging into an...

Malicious code in xxdxax (npm)

Source: amazon-inspector 8922341a391ea133f4e6b95d55da2a7ee404c99a9f88f75bdc2698d3f03cc97c The package's main file i.js is an obfuscated browser-side script — its de-obfuscated form is shipped alongside as original.js — that gates execution on window.location.href containing 'noviembrenacional.com...

CVE-2026-16262: Cross-Site Request Forgery (CSRF)

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

PT-2026-68871

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin WordPress plugin versions prior to 4.3.3 Description The plugin fails to bind its OAuth social login flow to the initiating user session. This allows an unauthenticated attacker to perform a login CSRF Cross-Site...

Security update for perl-Mojolicious (moderate)

openSUSE Security Update: Security update for perl-Mojolicious Announcement ID: openSUSE-SU-2026:0278-1 Rating: moderate References: 1271431 Cross-References: CVE-2026-15747 CVSS scores: CVE-2026-15747 SUSE: 5.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products:...

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS has an authenticated remote code execution issue in the control panel element-search condition handling. Craft cleans the outer request-controlled condition array with Component::cleanseConfig, but Conditions::createCondition later decodes and merges the JSON string in condition.config...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the condition.config process. An attacker can execute arbitrary operating system commands, read sensitive...

CVE-2026-66686

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

CVE-2026-66681

Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...

CVE-2026-12605

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...

CVE-2026-12605

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin "gfresttoken" to attacker-controlled host if the victim is authenticated into the Admin Console - full unauthenticated takeover of Eclipse GlassFish domain until the token expires...

CVE-2026-12605

In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin gfresttoken to attacker-controlled host if the victim is authenticated into the Admin Console -\ full unauthenticated takeover of Eclipse GlassFish domain until the token expires...

CVE-2026-70556 Hubzilla version prior to 11.4 CSRF via OAuth2 /authorize Endpoint App Registration

Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a...

EUVD-2026-53869

Hubzilla 11.2.1 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST...

CVE-2026-70556

Hubzilla 11.2.1 contains a CSRF vulnerability in the OAuth2 /authorize endpoint (Zotlabs\Module\Authorize::post()) that lets unauthenticated attackers silently register arbitrary OAuth2 applications under a victim’s authenticated account by submitting a cross-origin POST without CSRF token or Ori...

WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Plugins Garbage Collector Database Cleanup versions = 0.14...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

CVE-2026-14204

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim o...