CVE-2026-9591: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to /api/news-items, due to missing anti-CSRF protection...

CVE-2026-22342: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in WordPress Dating Theme = 11.2.0 versions...

WordPress Plugin: emergency-password-reset: CVE-2024-35648: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in Andy Moyle Emergency Password Reset allows Cross Site Request Forgery. This issue affects Emergency Password Reset: from n/a through 8.0...

WordPress Theme: niveau: CVE-2024-34810: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery. This issue affects Skyline WP: from n/a through 1.0.10...

io.quarkiverse.renarde:quarkus-renarde (>=3.0.13, <=3.0.20), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.0.13, <=3.0.20) +14 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.9.0.cr1, <=3.20.6.1)

io.quarkus:quarkus-rest-csrf MAVEN version =3.9.0.cr1, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.20 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

io.quarkiverse.renarde:quarkus-renarde (>=3.1.4, <=3.1.6), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.4, <=3.1.6) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-rest-csrf MAVEN version =3.28.0.cr1, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.28.0.cr1, =3.33.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

io.quarkiverse.renarde:quarkus-renarde (>=3.1.7, <=3.1.10), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.7, <=3.1.10) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.34.0.cr1, <=3.36.2)

io.quarkus:quarkus-rest-csrf MAVEN version =3.34.0.cr1, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.34.0.cr1, =3.36.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

io.quarkiverse.renarde:quarkus-renarde (>=3.1.0, <=3.1.3), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.0, <=3.1.3) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.21.0.cr1, <=3.27.4)

io.quarkus:quarkus-rest-csrf MAVEN version =3.21.0.cr1, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.21.0.cr1, =3.27.4 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

io.quarkus:quarkus-rest-csrf-deployment (3.37.0.cr1) potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (3.37.0.cr1)

io.quarkus:quarkus-rest-csrf MAVEN version 3.37.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-rest-csrf and may be impacted: - io.quarkus:quarkus-rest-csrf-deployment 3.37.0.cr1 Source cves: CVE-2026-50559 Source advisory:...

Server-side Request Forgery (SSRF)

Overview @lobehub/lobehub is a LobeHub - an open-source,comprehensive AI Agent framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application. Affected versions of this package are...

CVE-2026-49043 WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in WP Migrate Lite = 2.7.8 versions...

React Router: Potential CSRF via PUT/PATCH/DELETE document requests

Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight, SameSite cookies already block the cross-origin attack vectors...

CVE-2026-48518 MultiJuicer: Login CSRF allows attacker to force victims into their team

MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint POST /multi-juicer/api/teams/team/join accepted requests with any Content-Type, including text/plain. Because tha...

CVE-2026-48518

MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint POST /multi-juicer/api/teams/team/join accepted requests with any Content-Type, including text/plain. Because tha...

CVE-2016-20083 WordPress More Fields Plugin 2.1 Cross-Site Request Forgery

WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxe...

CVE-2016-20074 WordPress Lazy Content Slider Plugin 3.4 CSRF

WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via...

CVE-2026-49043: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in WP Migrate Lite = 2.7.8 versions...

CVE-2026-48518: Cross-Site Request Forgery (CSRF)

MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint POST /multi-juicer/api/teams/team/join accepted requests with any Content-Type, including text/plain. Because tha...

CVE-2016-20067: Cross-Site Request Forgery (CSRF)

WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML pages that execute unwanted poll operations when administrators visit the page while logged in...

CVE-2016-20074: Cross-Site Request Forgery (CSRF)

WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via...