23390 matches found
CVE-2026-72578
A cross-site request forgery CSRF vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator...
CVE-2026-66642 WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2...
CVE-2026-66642
WP Umbrella WordPress plugin versions up to 2.26.2 are affected by a Cross-Site Request Forgery (CSRF) vulnerability. Affected: WP Umbrella from n/a through 2.26.2. CVSSv3.1: base score 5.4 (Medium); Vector: Network; Attack complexity: Low; Privileges required: None; User interaction required; Im...
EUVD-2026-55261
Cross-Site Request Forgery CSRF vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2...
CVE-2026-66642 WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2...
CVE-2026-66642
Cross-Site Request Forgery CSRF vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from n/a through 2.26.2...
WordPress WP Umbrella plugin 2.24.2-2.26.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Anthony Green Antnation in WordPress Plugin WP Umbrella versions 2.24.2-2.26.2...
ROS-20260810-73-0035
The vulnerability in python-authlib is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...
CVE-2026-46409 OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution
OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...
CVE-2026-46409 OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution
OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...
CVE-2026-16262
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...
CVE-2026-16262 Estatik < 4.3.3 - Login CSRF
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...
EUVD-2026-54390
The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...
Exploit for Cross-Site Request Forgery (CSRF) in Apache Zeppelin
CVE-2026-44613 Donate Support the maintenance of this pro...
Malicious code in xxdxax (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8922341a391ea133f4e6b95d55da2a7ee404c99a9f88f75bdc2698d3f03cc97c The package's main file i.js is an obfuscated browser-side script — its de-obfuscated form is shipped alongside as original.js — that gates execution...
WordPress Simple Link Directory Pro plugin <= 15.0.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by luc in WordPress Plugin Simple Link Directory Pro versions = 15.0.8...
CVE-2026-66681
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
CVE-2026-28172
Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...
CVE-2026-66686 WordPress Plugins Garbage Collector (Database Cleanup) plugin <= 0.14 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...