CVE-2026-1208

CVE-2026-1208: Cross-Site Request Forgery in Friendly Functions for Welcart Keywords: CVE-2026-1208, Friendly Functions for Welcart vulnerability, CSRF, Cross-Site Request Forgery, WordPress security, WordPress plugin vulnerability, CWE-352, Welcart security, settings manipulation, WordPress CVE...

CVE-2025-29722

🛡️ CVE-2025-29722 – Cross Site Request Forgery CSRF in Commercify v1.0 Discovered by: David P.S Abraham aka Davycipher CVE ID CVE-2025-29722 has been assigned to this vulnerability by MITRE Corporation. Summary A CSRF vulnerability was identified in Commercify v1.0 , an open-source e-commerce...

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain,...

BIT-KIBANA-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

BIT-ELK-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

Exploit for CVE-2026-73847

CVE-2026-73847 — emlog AI Assistant CSRF → SQL Execution → Adm...

Security Bulletin: This Power System update is being released to address CVE-2026-18848

Summary Power Systems Firmware is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resultin...

CVE-2026-57469

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469 Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469

Nozomi Networks Labs identifies a CSRF vulnerability (CWE-352) in the web-based configuration backend of KUNBUS PiCtory v2.16.0. The issue allows a remote unauthenticated attacker to perform state-changing actions within an authenticated operator session by tricking a victim into submitting craft...

CVE-2026-57469

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469 Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

PT-2026-72037

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-72658

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

EUVD-2026-58269

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

CVE-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

CVE-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

CVE-2026-72658

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

CVE-2026-72658

CVE-2026-72658 describes a Cross-Site Request Forgery (CWE-352) in Kibana that can lead to privilege escalation when a user who can create visualizations saves a specially crafted Vega visualization. When another user opens that visualization, authenticated requests are issued in the viewing user...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-99)

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when i...