SUSE CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-102807

OpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to execute MCP App tools requiring operator.write scope. Attackers with operator.read tokens can obtain a standalone ticket from mcp.app.view and redeem it at th...

CVE-2026-102807

OpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to execute MCP App tools requiring operator.write scope. Attackers with operator.read tokens can obtain a standalone ticket from mcp.app.view and redeem it at th...

AZL-105245 CVE-2026-101902 affecting package python-tensorboard 2.16.2-6

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-101902

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

CVE-2026-82380

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

CVE-2026-82380 Apache Roller: CSRF protection bypass via self-generated salt validation

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

EUVD-2026-88141

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

CVE-2026-82380 Apache Roller: CSRF protection bypass via self-generated salt validation

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

CVE-2026-82380 Apache Roller: CSRF protection bypass via self-generated salt validation

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

CVE-2026-82380

A Cross-Site Request Forgery (CSRF) vulnerability exists in Apache Roller 6.1.5 . The flaw is caused by CSRF validation filters incorrectly accepting requests that lack a required salt token , instead validating against a value the server itself generated for the request. This allows a remote att...

CVE-2026-82380: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...

PT-2026-108346

Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes...

PT-2026-99800

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description Cross-Site Request Forgery CSRF occurs when the CSRF validation filters accept requests that omit the required salt token, instead validating against a value generated by the server for that request. Thi...

CVE-2026-100524

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524

Cotonti versions through 1.0.0 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within the extensions manager . The root cause is a lack of anti-CSRF token validation , which allows an attacker to perform state-changing actions. By tricking an authenticated administrator into v...

EUVD-2026-87379

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...