CVE-2026-40864

CVE-2026-40864 — Bypass de XSRF en JupyterHub mediante POST de formulario entre orígenes Sec-Fetch-Mode: no-cors Gravedad : Moderada CWE : CWE-352 — Falsificación de solicitudes entre sitios XSRF Afecta : jupyterhub 4.1.0 ≤ versión 5.4.5 corregido en 5.4.5 Aviso : GHSA-m68r-v472-jgq9 NVD :...

CVE-2026-82468

Rodauth versions before 2.47.0 contain a cross-site request forgery (CSRF) protection bypass in the JSON request content type validation. An attacker can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation, forcing victims to aut...

CVE-2026-82468 Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to...

CVE-2026-80210

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...