959 matches found
CVE-2026-63150
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $GET and $POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link ...
CVE-2026-63150
The Omnispace Agora Project (through version 26.10.0 ) is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. The root cause is the application's failure to require an anti-CSRF token while merging $_GET and $_POST parameters. Furthermore, the vulnerability is exacerbated by SameSit...
EUVD-2026-125521
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $GET and $POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link ...
CVE-2026-63150 Omnispace Agora Project 26.10.0 CSRF via Administrator Account Creation
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $GET and $POST parameters without requiring an anti-CSRF token. Attackers can craft a malicious link ...
halo-cve-2026-67919
halo plugin rce from a url halo's console lets admins install and upgrade plugins by pasting a url. it fetches whatever url, installs the jar, and the jar's code runs on the server. no scheme checks, no host checks, redirects followed, and the plugin manager loads the extension classes straight o...
CVE-2026-73292
CVE-2026-73292 – CSRF Password Change in Semaphore UI For educational and responsible disclosure purposes only. This vulnerability has been reported in GHSA-8cj9-r88m-8945 and affect semaphoreui versions below 2.18.21. Vulnerability The password change endpoint of Semaphore UI does not implement...
EUVD-2026-124537
The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions...
CVE-2026-16052
The http.cookies.Morsel class is vulnerable to cookie attribute injection because it allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker capable of controlling these values could exploit this flaw to relax cookie Domain or SameSite restric...
UBUNTU-CVE-2026-126067
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...
CVE-2026-126067
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...
CVE-2026-126067
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...
CVE-2025-28355
CVE-2025-28355 It was identified that the https://github.com/Volmarg/personal-management-system application is vulnerable to CSRF attacks, one of the many action an attacker can perform is trick a legitimate user to run a cross site request that will alter his/her password, allowing the attacker...
CVE-2026-126067
A flaw was found in Action Pack. Certain non-cookie session stores fail to apply the configured SameSite attribute when issuing session cookies. In web browsers that do not automatically enforce cross-site cookie restrictions, a remote attacker could induce an authenticated user's browser to send...
Linux Distros Unpatched Vulnerability : CVE-2026-126067
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than...
Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores
Impact Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins write the session cookie without a SameSite attribute, regardless of...
GHSA-GMJ8-HVJ3-49MW Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores
Impact Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins write the session cookie without a SameSite attribute, regardless of...
CVE-2026-126067
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...
DEBIAN-CVE-2026-126067
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...
CVE-2026-126067 Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...
CVE-2026-126067
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...