EUVD-2026-120054

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hashhmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

CVE-2026-124624 PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hashhmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

CVE-2026-124624 PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hashhmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

CVE-2026-124624: n/a PipraPay: A weakness has been identified in PipraPay 3.0.0

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hashhmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

PT-2026-140414

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from...

VulnCheck KEV: CVE-2026-62856

FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a...

CVE-2026-8640

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the...

CVE-2026-84229

IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests...

CVE-2026-8640

The IBM Security Verify Directory Web Application is vulnerable to Cross-Site Request Forgery (CSRF) attacks because it fails to set the SameSite attribute on session cookies. This flaw allows an attacker to induce authenticated users' browsers to transmit unauthorized requests to the application...

EUVD-2026-119735

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the...

CVE-2026-8640 IBM Verify Directory is affected by multiple vulnerabilities

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the...

CVE-2026-84229

IBM Guardium Data Protection version 12.2.4 is vulnerable to a security restriction bypass due to improper validation of CSRF tokens for GET requests (CWE-352 ). A remote attacker can exploit this flaw to impact the integrity of the system. To remediate this vulnerability, IBM encourages customer...

EUVD-2026-119732

IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests...

CVE-2026-84229 IBM Guardium Data Protection is affected by multiple vulnerabilities

IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests...

CVE-2026-124488

OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via loadform.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content...

EUVD-2026-119606

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

CVE-2026-124474

The Meeting Room Booking System (MRBS) version before 1.12.3 is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The issue resides in the view_entry.php file, where an unauthenticated attacker can inject scripts via the error parameter . By sending crafted links to authenticate...

CVE-2026-124488 OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters

OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via loadform.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content...

login-range

login-range A self-contained attack range for login pages...

CVE-2026-103303

The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks again...