CVE-2026-69206 Http4s: DigestAuth allows replay of captured requests

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonce-count value it has accepted. When a legitimate client sends noncontiguous nc values because of parallel or retried requests, the stored...

CVE-2026-82712

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device...

EUVD-2026-71753

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device...

CVE-2026-82712 Tycon Systems TPDIN-Monitor-WEB3 Cross-Site Request Forgery

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device...

CVE-2026-82712

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are affected by a cross-site request forgery (CSRF) flaw that allows an attacker to perform state-changing operations on the device, including factory resets , credential extraction, and data theft. The product is deployed in critical manu...

CVE-2026-82712: Cross-Site Request Forgery (CSRF)

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device...

PT-2026-83310

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

CVE-2026-82287: Permissive Cross-domain Policy with Untrusted Domains

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website t...

EUVD-2026-58806

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-57469

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469 Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469

Nozomi Networks Labs identifies a CSRF vulnerability (CWE-352) in the web-based configuration backend of KUNBUS PiCtory v2.16.0. The issue allows a remote unauthenticated attacker to perform state-changing actions within an authenticated operator session by tricking a victim into submitting craft...

CVE-2026-57469

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

PT-2026-72037

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469: Cross-Site Request Forgery (CSRF)

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-67366: Cross-Site Request Forgery (CSRF)

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-73162

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

CVE-2026-73162

Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: /account/follow /account/deletenotification /account/marknotificationread /account/markallread These endpoints require authentication, but before the fix they could be invoked with simple GET...

CVE-2025-13394

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery CSRF attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechani...

PT-2026-68442

Name of the Vulnerable Software and Affected Versions Carbon console affected versions not specified Description The Ajax processor fails to protect state-changing operations from Cross-Site Request Forgery CSRF, a type of attack that tricks an authenticated user into executing unintended actions...