CVE-2026-81912

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-68526

Concrete CMS before 9.5.3 is affected by a missing anti-CSRF token validation in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php), specifically in its submit() action. The action only checked canAccess() and the per-resource canAddCalendarEvent() pe...

CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

EUVD-2026-76243

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-62139

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

CVE-2026-62133

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-81910

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-62139 WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

EUVD-2026-76198

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

CVE-2026-62133

WordPress plugin RTMKit (part of the Rometheme for Elementor plugin) contains a Cross-Site Request Forgery (CSRF) vulnerability in versions 2.1.5 and earlier . The vulnerability can be triggered by a user with Subscriber level privileges and was discovered by MYUNGYONG LEE . The CVSS 3.1 base sco...

CVE-2026-62133 WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

EUVD-2026-76204

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

CVE-2026-62133 WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to server-side request forgery due to axios ( CVE-2025-62718 )

Summary Potential vulnerabilities in axios package CVE-2025-62718 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not...

Exploit for CVE-2026-85612

CVE-2026-85612 CVE-2026-85612https://vulners.com/cve/CVE-20...

CVE-2026-89245 WWBN AVideo Cross-Site Request Forgery via playlistRemove.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

CVE-2026-89245

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in playlistRemove.php . The root cause is that CSRF protection checks can be bypassed, allowing an attacker to craft a malicious form that submits a POST request to the e...

CVE-2026-89245 WWBN AVideo Cross-Site Request Forgery via playlistRemove.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...