SUSE-SU-2026:2968-1 Security update for python-Authlib

This update for python-Authlib fixes the following issues - CVE-2026-41425: Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starletteclient.OAuth bsc1263114. - CVE-2026-44681: Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's...

CVE-2026-11563

The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full...

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Summary The official Kimai Docker image ships with APPSECRET=changethistosomethingunique as the default environment variable. The Docker entrypoint does not override or validate this value. Any Kimai instance deployed using the Docker image without explicitly setting APPSECRET runs with a...

Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

Summary Kimai 2.56.0 contains authenticated cross-site request forgery issues in its timesheet state-changing API endpoints. The application reuses the browser's existing session for /api/ requests, and both the stop and restart operations are exposed through GET and PATCH routes that directly...

CVE-2026-52100: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function...

CVE-2026-11563: Undefined Security Weakness

The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full...

CVE-2026-58476: Cross-Site Request Forgery (CSRF)

Sustainable Irrigation Platform SIP through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing administrative actions by luring a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSR...

PT-2026-58031

Sustainable Irrigation Platform SIP through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing administrative actions by luring a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSR...

CVE-2026-52100

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function...

CVE-2026-15747: Observable Response Discrepancy

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. csrftoken generates and caches one token per session and returns the same value on every call, and csrffield places that value in a hidden csrftoken input...

📄 SIP Sustainable Irrigation Platform 5.x Configuration Modification

SIP Sustainable Irrigation Platform version 5.x has a value-setting interface that copies every parameter received in an HTTP request directly into its internal settings object without restricting which settings may be changed. This can be exploited to modify arbitrary configuration values that t...

Security Bulletin: Multiple Vulnerabilities in React Router bundled with IBM Fusion, IBM Fusion HCI and IBM Fusion Data Cataloging

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the react-router library, which is affected by multiple vulnerabilities, including cross-site scripting XSS, cross-site request forgery CSRF, and open redirect vulnerabilities. CVE-2026-21884, CVE-2026-22029, CVE-2026-2203...

CVE-2026-58489

HedgeDoc prior to v1.11.0 is vulnerable to a CSRF-like flaw in the GitHub Gist export callback. The OAuth2 state value was only checked for presence, not validated against the user session, allowing an attacker to craft a callback URL with their own valid GitHub OAuth code. When a logged-in victi...

Cross-site Request Forgery (CSRF)

Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the apiMiddleware request filter in src/apiMiddleware.ts. An attacker can create accounts or change configuration by causing a logged-in administrator’s browser to send a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the MediaUploader upload flow in MediaUploader.php and the SVG file sanitizer path. An attacker can execute arbitrary JavaScript by uploading a crafted image/svg+xml file containing onload handlers, tags, or...

CVE-2026-61502

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a...

CVE-2026-49971

Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attacker...

CVE-2026-61502

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a...

EUVD-2024-24347

GeoNode: Stored XSS to full account takeover...

PYSEC-2026-2418 CKAN has CSRF exemption primed by anonymous requests

Views can be marked as exempt from CSRF protection Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect, which was stored as a module level variable in the flaskapp...