halo-cve-2026-67919

halo plugin rce from a url halo's console lets admins install and upgrade plugins by pasting a url. it fetches whatever url, installs the jar, and the jar's code runs on the server. no scheme checks, no host checks, redirects followed, and the plugin manager loads the extension classes straight o...

CVE-2026-73292

CVE-2026-73292 – CSRF Password Change in Semaphore UI For educational and responsible disclosure purposes only. This vulnerability has been reported in GHSA-8cj9-r88m-8945 and affect semaphoreui versions below 2.18.21. Vulnerability The password change endpoint of Semaphore UI does not implement...

CVE-2025-28355

CVE-2025-28355 It was identified that the https://github.com/Volmarg/personal-management-system application is vulnerable to CSRF attacks, one of the many action an attacker can perform is trick a legitimate user to run a cross site request that will alter his/her password, allowing the attacker...

EUVD-2026-107368

Electron: SameSite cookie restrictions are not applied to windows opened from links...

npm: Electron: SameSite cookie restrictions are not applied to windows opened from links

npm: Electron: SameSite cookie restrictions are not applied to windows opened from links vulnerability discovered by ? in WordPress npm electron versions 42.11.3...

CVE-2026-113796

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-113796

The Electron framework (prior to versions 42.11.3 , 43.7.0 , 44.3.0 , and 45.0.0-alpha.6 ) fails to correctly apply SameSite cookie restrictions when opening new windows via links. The framework incorrectly treats these as application-initiated navigations rather than preserving the initiating pa...

CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

PT-2026-120672

Name of the Vulnerable Software and Affected Versions Electron versions prior to 42.11.3 Electron versions prior to 43.7.0 Electron versions prior to 44.3.0 Electron versions prior to 45.0.0-alpha.6 Description Electron incorrectly treats pages opened in a new window from links as...

Astra Linux – Vulnerability in Firefox and Thunderbird

Requests initiated through the reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

CVE-2026-102899

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the...

CVE-2022-51020: Cross-Site Request Forgery (CSRF)

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke t...

CLEANSTART-2026-MK68457 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute

Security vulnerability affects the apache-nifi-registry package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

CLEANSTART-2026-BU33192 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute

Security vulnerability affects the rundeck package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

Astra Linux – Vulnerability in python-tornado

In Tornado before version 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments of .RequestHandler.setcookie were not checked for crafted characters...

CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

EUVD-2026-87371

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-92751

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...