PT-2026-118025

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs in github.com/0xJacky/Nginx-UI...

CVE-2026-112033: Cross-Site Request Forgery (CSRF)

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function adminrepwd/adminrepwdact of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery...

PT-2026-117168

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin repwd/admin repwd act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request...

CVE-2026-107084: Undefined Security Weakness

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loanhistorymaintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data los...

CVE-2026-110008: Cross-Site Request Forgery (CSRF)

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the...

CVE-2026-107084

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loanhistorymaintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data los...

CVE-2026-84178: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18.5, from 4.19.0 before 4.22.1. The authorization code callback did not carry a state parameter binding it to the authorization request that started the flow, and...

PT-2026-117517

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loan history maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data...

CVE-2026-111883: Cross-Site Request Forgery (CSRF)

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

Roundcube -- Multiple vulnerabilities

The Roundcube Mail project reports: IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action bug where an alias login wasn’t qualified by IMAP host Add a size limit to the CSS proxy content processing SSRF filter islocalurl bypass via NAT64 64:ff9b::/96 remote...

CVE-2026-107084

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loanhistorymaintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data los...

EUVD-2026-104552

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows cross-site request forgery CSRF against admin/modules/circulation/loanhistorymaintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF token or POST confirmation, leading to data los...

PT-2026-118071

Casdoor SSO callback uses a constant state parameter login CSRF in github.com/0xJacky/Nginx-UI...

CVE-2026-107084

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability affecting the admin/modules/circulation/loan_history_maintenance.php endpoint. The flaw exists because the action=run GET parameter performs privileged and destructive oper...

Apache Camel Cross-Site Request Forgery Vulnerability

Versions of Apache Camel from 4.11.0 to 4.18.5 and from 4.19.0 to 4.22.1 contain a cross-site request forgery vulnerability. This vulnerability stems from the OAuth component’s authorization code callback not carrying and verifying the state parameter. This can lead to login cross-site request...

CVE-2026-112050

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...

CVE-2026-112050 Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...

EUVD-2026-103512

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...

CVE-2026-112050 Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened...

CVE-2026-112050

Versions of Gitify before 7.10.0 are vulnerable to a login cross-site request forgery (CSRF) . The issue stems from the performGitHubWebOAuth() function omitting OAuth state validation . A remote attacker can trick a victim into binding their client to the attacker's account by providing a gitify...