CVE-2026-80210 FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms

FrontAccounting through 2.4.20 generates a CSRF token in endform in includes/ui/uicontrols.inc and embeds it as the token hidden field in every form it renders, but only admin/users.php and admin/changecurrentuserpassword.php call checkcsrftoken to validate it. No financial transaction handler...

CVE-2026-80210

FrontAccounting through 2.4.20 suffers from a Cross-Site Request Forgery (CSRF) flaw in its financial transaction forms. The application generates a CSRF token in end_form() (includes/ui/ui_controls.inc) and embeds it as the _token hidden field, but only admin/users.php and admin/change_current_u...

CVE-2026-71959

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log...

EUVD-2026-55631

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log...

CVE-2026-66486

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with...

CVE-2026-66486

GNU cpio is vulnerable to improper output encoding in archive member listings. When listing members with cpio -it, member names are printed directly to output without quoting or escaping, allowing crafted member names containing newline characters or ANSI escape sequences to produce forged listin...

WordPress plugin Debug Log Manager – Conveniently Monitor and Inspect Errors 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-25766

LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

Log Injection

Jenkins is vulnerable to Log Injection. The vulnerability is due to insufficient restriction or sanitization of user-supplied content in log messages, which allows an attacker to inject line break characters and forge log entries, misleading administrators during log reviews...