PT-2026-65804

Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox 2.20.2...

PT-2026-65686

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2026-65738

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the global scope, included by fvcr admin page html function. This makes it possible for...

WordPress FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle vulnerability

Cross-Site Request Forgery to Sync Rule Status Toggle vulnerability discovered by Deadbee in WordPress Plugin FuseWP versions = 1.1.24.2...

WordPress Facturación Electrónica Costa Rica plugin <= 2.0.2 - Cross-Site Request Forgery to Plugin Settings Update vulnerability

Cross-Site Request Forgery to Plugin Settings Update vulnerability discovered by swat in WordPress Plugin Facturación Electrónica Costa Rica versions = 2.0.2...

EUVD-2026-49994

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...

CVE-2026-48060 Litestar: HTML Injection Through CSRF Token

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...

CVE-2026-47725

Summary (CVE-2026-47725) Nebula-mesh web UI lacked CSRF protection on all /ui/* mutating endpoints (POST/PUT/PATCH/DELETE) prior to v0.3.3. A session-cookie/Lax-SameSite boundary and third-party page triggers (including a forced GET /ui/logout via an image tag) enable potential privilege escalati...

CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...

CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...

CVE-2026-58338

A flaw was found in Moodle. The user profile page reset action did not properly implement a token to prevent Cross-Site Request Forgery CSRF. A remote attacker could exploit this vulnerability to perform unauthorized actions on behalf of an authenticated user, potentially leading to unintended...

CVE-2026-58337

A flaw was found in Moodle. The user homepage preference setting lacked a necessary token, making it vulnerable to a Cross-Site Request Forgery CSRF attack. A remote attacker could exploit this to trick a user into performing unwanted actions on the Moodle platform without their knowledge,...

CVE-2026-63301

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

CVE-2026-58340

A flaw was found in Moodle. The grade item ID number editing functionality lacked proper security measures, making it vulnerable to Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS. A remote attacker could exploit these vulnerabilities to perform unauthorized actions or inject malicio...

CVE-2026-58344

A flaw was found in Moodle. The regrade action in the quiz overview report did not include the necessary token, leading to a Cross-Site Request Forgery CSRF vulnerability. A remote attacker could exploit this by tricking an authenticated user into performing unintended actions, such as regrading...

CVE-2026-58341

A flaw was found in Moodle. The actions to enable and disable group messaging did not include the necessary token to prevent a Cross-Site Request Forgery CSRF risk. A remote attacker could exploit this by tricking an authenticated user into performing unintended actions, potentially leading to...

EUVD-2026-49754

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

CVE-2026-63301 Denial of Service in Quick.CMS

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

CVE-2026-63301

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

CVE-2026-14516

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...