CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875

The Quick.Cart software contains a Cross-Site Request Forgery (CSRF) vulnerability within the admin config panel . An attacker can craft a malicious website that, when visited by an administrator, automatically sends a POST request to modify the administrator's login credentials and password. Whi...

EUVD-2026-88741

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

Server-Side Request Forgery

Apache Shiro is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of the form‑resubmit target in the Jakarta EE integration module, where the server will initiate an outbound connection to a URL supplied in a crafted HTTP request and transmit...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in fast-uri.

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in fast-uri. CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parse...

Cross-Site Request Forgery

Apache Wicket is vulnerable to cross-site request forgery. The vulnerability is due to unsafe allowances in the default FetchMetadataResourceIsolationPolicy, where any "simple top-level navigation" GET request is allowed regardless of Sec-Fetch-Site and Sec-Fetch-Mode, and Sec-Fetch-Site: same-si...

CVE-2026-102244

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

EUVD-2026-88618

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244 MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file surfsensebackend/app/routes/editorroutes.py of the component Document Export Feature. Performing a manipulation results in server-side request forgery. The attack can be initiated...

CVE-2026-102244

MODSetter SurfSense versions up to 0.0.36 are vulnerable to a server-side request forgery (SSRF) flaw within the Document Export Feature . The vulnerability exists in an unspecified function located in surfsense_backend/app/routes/editor_routes.py. This flaw allows for remote manipulation that ca...

EUVD-2026-88561

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

CVE-2026-67993

The basecamp/upright software, specifically at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f , is vulnerable to a login cross-site request forgery (CSRF) issue. This vulnerability exists within the static credentials callback . While the impact is categorized as high severity (CVSS 8.8) involvi...

EUVD-2026-89426

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

CVE-2026-67993

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

PT-2026-102895

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download file and scrape web agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95362): chromium -- security fixes

Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...