EUVD-2026-87379

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524 Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-100524

Cotonti versions through 1.0.0 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within the extensions manager . The root cause is a lack of anti-CSRF token validation , which allows an attacker to perform state-changing actions. By tricking an authenticated administrator into v...

CVE-2026-96524: Cross-Site Request Forgery (CSRF)

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a...

PT-2026-99150

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0 Description The extensions manager lacks anti-CSRF token validation, leading to a cross-site request forgery issue. This allows authenticated administrators to be tricked into visiting a malicious page, where crafted link...

CVE-2026-100524: Cross-Site Request Forgery (CSRF)

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

CVE-2026-92609

A flaw was found in Apache Qpid Broker-J. The application does not renew session identifiers upon successful authentication, leading to a session fixation vulnerability in the HTTP management interface. A remote attacker can exploit this issue by establishing a session identifier prior to login a...

CVE-2026-55217

The asset and IT management software GLPI is vulnerable to an authorization bypass in versions 0.85 until 10.0.26 and 11.0.8 . A low-privileged authenticated user can perform unauthorized actions, including creating, updating, or deleting knowledge base comments and translations . This issue is a...

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper...

CVE-2026-93399

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...

EUVD-2026-86544

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...

PT-2026-98888

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.7.2-beta-1 Description InvoicePlane fails to enforce email syntax for client email values and renders them unescaped within double-quoted value attributes in the invoice mailer and quote mailer forms. This allows an...

VulnCheck KEV: CVE-2026-93399

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...

GHSA-FGMF-7RF8-M6VF ZITADEL: Actions V1 sandbox escape: host file read via require()

Summary A vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript require module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials including the Login Client PAT and...

ZITADEL: Actions V1 sandbox escape: host file read via require()

Summary A vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript require module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials including the Login Client PAT and...

CVE-2026-85057

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...

CVE-2026-85057

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...

CVE-2026-85057 ZITADEL: Actions V1 sandbox escape: host file read via require()

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...