23418 matches found
PT-2026-52829
Name of the Vulnerable Software and Affected Versions Paid Memberships Pro - Add Member From Admin versions prior to 0.7.3 Description An unauthenticated Cross Site Request Forgery CSRF exists, which allows attackers to execute unauthorized actions via crafted requests. CSRF is a type of attack...
PT-2026-52915
OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "useradmin". This vulnerability is fixed in 17.3.3 and 17.4.1...
PT-2026-52827
Unauthenticated Cross Site Request Forgery CSRF in Gmail SMTP = 1.2.3.19 versions...
PT-2026-52806
Unauthenticated Cross Site Request Forgery CSRF in FunnelKit Payment Gateway for Stripe WooCommerce = 1.14.0.3 versions...
PT-2026-52808
Unauthenticated Cross Site Request Forgery CSRF in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
GO-2026-5629 Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server
Mattermost doesn't properly validate CSRF tokens in github.com/mattermost/mattermost-server...
GO-2026-5495 Mattermost doesn't validate CSRF tokens on an authentication endpoint in github.com/mattermost/mattermost-server
Mattermost doesn't validate CSRF tokens on an authentication endpoint in github.com/mattermost/mattermost-server...
GO-2026-5232 Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs `/?redirect` endpoint in github.com/patrickhener/goshs
Unauthenticated Open Redirect, Arbitrary HTTP Response Header Injection, Missing CSRF, and Invisible-Mode Bypass in goshs /?redirect endpoint in github.com/patrickhener/goshs...
SUSE CVE-2026-53663
React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...
CVE-2026-57283
A flaw was found in Jenkins Pipeline: Groovy Plugin. This cross-site request forgery CSRF vulnerability allows attackers to instantiate types related to job or system configuration. This could enable unauthorized modifications to the Jenkins environment...
CVE-2026-52800 Gogs: CSRF Leading to Organization Owner Takeover
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be add...
CVE-2026-52800
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be add...
EUVD-2026-39069
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be add...
CVE-2026-52800 Gogs: CSRF Leading to Organization Owner Takeover
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be add...
CVE-2026-52800
CVE-2026-52800 (Gogs) : In Gogs 0.14.1 and earlier, organization team management endpoints were reachable via GET requests with CSRF protection disabled for GET, enabling state-changing actions like adding a user to the Owners team without proper CSRF checks. If the victim is an organization owne...
Cross-site Request Forgery (CSRF)
Overview io.jenkins.plugins:mcp-server is a The MCP Model Context Protocol Server Plugin for Jenkins implements the server-side component of the Model Context Protocol. This plugin enables Jenkins to act as an MCP server, providing context, tools, and capabilities to MCP clients, such as...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the connect process. An attacker can initiate unauthorized connections to arbitrary URLs using credentials IDs of their choosing by tricking a user into performing unwanted actions while authenticated...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the global job priority configuration process. An attacker can modify configuration settings by tricking an authenticated user into submitting a malicious request. Remediation Upgrade...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the process that handles external URL connections. An attacker can cause the system to connect to an arbitrary URL with attacker-controlled credentials by tricking an authenticated user into making a...
Cross-site Request Forgery (CSRF)
Overview org.jenkins-ci.plugins:assembla is a plugin that integrates Jenkins with Assembla tickets during SCM update / Build. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the process that handles external URL connections. An attacker can cause unauthoriz...