WordPress W3SC Elementor to Zoho CRM plugin <= 2.2.0 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by ? in WordPress Plugin W3SC Elementor to Zoho CRM versions = 2.2.0...

CVE-2026-60025 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection...

CVE-2026-60025 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection...

CVE-2026-60025

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection...

CVE-2024-23570

HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame on his malicious site. The attacker can then launch a Clickjacking attack, which may lead to Phishing, Cross-Site Request Forger...

CVE-2024-23570

HCL Aftermarket EPC is affected by clickjacking vulnerability Cross-Frame Scripting is an attack technique where an attacker loads a vulnerable application in an iFrame on his malicious site. The attacker can then launch a Clickjacking attack, which may lead to Phishing, Cross-Site Request Forger...

CVE-2024-23570

CVE-2024-23570 affects HCL Aftermarket EPC and describes a clickjacking/Cross-Frame Scripting risk. The CVSSv3.1 base score is 4.3 (Medium) with network attack vector, low attack complexity, no privileges required, user interaction required. Impact notes indicate confidentiality and availability ...

EUVD-2026-45082

grav-plugin-login before 3.8.11 contains a cross-site request forgery CSRF vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core...

CVE-2026-62236 grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret

grav-plugin-login before 3.8.11 contains a cross-site request forgery CSRF vulnerability in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated session user without any anti-CSRF nonce or Origin/Referer check. Because Grav core...

CVE-2026-62236

grav-plugin-login before 3.8.11 contains a CSRF in the login.regenerate2FASecret frontend task, which regenerates and persists a new TOTP secret for the authenticated user without anti-CSRF nonce or Origin/Referer checks. Grav core dispatches the task via a top-level GET using the task: URI param...

EUVD-2026-45120

Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF...

PT-2026-60756

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The software is susceptible to clickjacking via Cross-Frame Scripting, a technique where an attacker embeds the vulnerable application within an iFrame on a malicious website. Thi...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Authlib vulnerabilities (USN-8557-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8557-1 advisory. Jay Neiva and Mauro Carrillo discovered that Authlib did not properly validate cryptographic keys embedded in JWT headers. An...

MAL-2026-10752 Malicious code in xxdxa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a77171f4b68ff814a7a99b5e51e3d59b9d4ca41fefbd650d2a0f8412878360 The package's sole file i.js declared as main is a heavily obfuscated IIFE whose top-level exploit runs unconditionally when the module is loaded. In...

USN-8557-1: Authlib vulnerabilities

Jay Neiva and Mauro Carrillo discovered that Authlib did not properly validate cryptographic keys embedded in JWT headers. An attacker could possibly use this issue to forge trusted tokens, resulting in authentication and authorization bypass. CVE-2026-27962 Jay Neiva and Mauro Carrillo discovere...

USN-8557-1 python-authlib vulnerabilities

Jay Neiva and Mauro Carrillo discovered that Authlib did not properly validate cryptographic keys embedded in JWT headers. An attacker could possibly use this issue to forge trusted tokens, resulting in authentication and authorization bypass. CVE-2026-27962 Jay Neiva and Mauro Carrillo discovere...

CVE-2026-35143

HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery CSRF attacks if additional mitigations,...

CVE-2026-35143

CVE-2026-35143 affects HCL DFXAnalytics and is described as a Missing SameSite Attribute vulnerability where session cookies generated during authentication do not set the SameSite attribute. The lack of SameSite on cookies could allow a remote attacker to perform Cross-Site Request Forgery (CSRF...

CVE-2026-35143 HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability.

HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery CSRF attacks if additional mitigations,...

CVE-2026-35143 HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability.

HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery CSRF attacks if additional mitigations,...