CVE-2026-14204 Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF

The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim o...

RackTables CSRF

The vulnerability in the web application for managing assets in data processing centers called RackTables is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

EUVD-2026-53603

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

EEF-CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF

Summary Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4...

CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

CVE-2026-66885 Livebook Teams identity callback lacks state binding, allowing login CSRF

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

CVE-2026-66885

Cross-Site Request Forgery CSRF vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under the attacker's own Livebook Teams identity. When Livebook is configured to use Livebook Teams for identity, Livebook.ZTA.LivebookTeams.handlerequest/4 in...

CVE-2026-70434

A cross-site request forgery CSRF vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2026-70432

A cross-site request forgery CSRF vulnerability in Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-70434

A cross-site request forgery CSRF vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

EUVD-2026-53528

A cross-site request forgery CSRF vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2026-70434

A cross-site request forgery CSRF vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

CVE-2026-70434

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins SCM-Manager Plugin version 1.11.1 and earlier . The flaw allows attackers with Overall/Read permissions to connect to an attacker-specified URL using credentials IDs obtained through other methods, potentially capturing crede...

CVE-2026-70432

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins Multijob Plugin (version 669.v9d96a_d9c71b_0 and earlier). The root cause is that the plugin fails to require POST requests for a specific form validation endpoint. This flaw allows an attacker to execute arbitrary code withi...

CVE-2026-70432

A cross-site request forgery CSRF vulnerability in Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-70432

A cross-site request forgery CSRF vulnerability in Jenkins Multijob Plugin 669.v9d96ad9c71b0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM...

CVE-2026-7326

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthoriz...

CVE-2026-7326 Cross-site request forgery in Progress MarkLogic Server Admin UI

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthoriz...

EUVD-2026-53421

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthoriz...