CVE-2026-105296

Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed...

CVE-2026-105296

Multiple Akeeba products are vulnerable to Cross-Site Request Forgery (CSRF) because they lack anti-CSRF checks on certain actions. An attacker could perform unintended operations if a logged-in user visits a malicious webpage. No specific exploit information or remediation steps are provided in ...

EUVD-2026-116707

Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed...

PT-2026-137120

vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf check in include/utils/VteCsrf.php skips csrf token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read...

CVE-2026-114456: Snowflake: Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have…

Multiple Snowflake client drivers implementing the authenticator=externalbrowser single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener...

PT-2026-136929

Multiple Snowflake client drivers implementing the authenticator=externalbrowser single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener...

CVE-2026-63433

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest, which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey val...

EUVD-2026-116195

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest, which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey val...

CVE-2026-63433 MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest, which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey val...

CVE-2026-63433 MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value

MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest, which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey val...

CVE-2026-63433

The self-hosted video downloader and player MyTube is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.10.6 . The root cause is located in backend/src/middleware/csrfConfig.ts, where the shouldSkipCsrfProtection() function incorrectly grants a CSRF exemption by chec...

CVE-2026-110008

A flaw was found in @fastify/oauth2. Due to inconsistent cookie path handling during the authentication process, temporary verification cookies are not properly removed after the login flow completes. As a result, single-use authentication tokens persist throughout the user's browser session. A...

CVE-2026-107226

A flaw was found in AsyncHttpClient. The default cookie store fails to track whether cookies were received over an encrypted connection, allowing unencrypted HTTP responses to plant, overwrite, or delete cookies designated with the Secure attribute. A remote attacker capable of returning an...

CVE-2026-121551

PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can...

CVE-2026-121551 PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description

PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can...

CVE-2026-121551

PostfixAdmin versions through 4.0.5 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue arises when authenticated mailbox users create a TOTP exception containing an unescaped description . If a global administrator views the totp-exceptions.php page, the injected script execute...

CVE-2026-121551 PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description

PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can...

CVE-2026-121451

AB Download Manager versions prior to 1.11.2 are vulnerable to a cross-site request forgery (CSRF) vulnerability within its unauthenticated browser-integration API. An attacker can exploit this by tricking a user into visiting a malicious webpage that sends a text/plain request to the /start-head...

CVE-2026-121451 AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...

CVE-2026-121451 AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF

AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with...