CVE-2026-5702: SABBATIC SABBATIC app: Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an…

Cross-Site Request Forgery CSRF vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint...

PT-2026-132847

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$ REQUEST, including id, idatendido, idInterno, and...

CVE-2026-61671: LabRedesCefetRJ WeGIA: WeGIA is a web manager for charitable institutions

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...

CVE-2026-115300: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two…

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

Linux Distros Unpatched Vulnerability : CVE-2026-118266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. Wh...

CVE-2026-110983: Unknown WP Photo Album Plus: The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of…

The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page...

CVE-2026-27062: WPFunnels Team WPFunnels: Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request…

Cross-Site Request Forgery CSRF vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5...

PT-2026-130652

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and...

PT-2026-132096

Cross-Site Request Forgery CSRF vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint...

CVE-2026-115299: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail…

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in...

EUVD-2026-110038

vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server...

Cross-site Request Forgery (CSRF)

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the MethodOverride middleware in middleware/methodoverride.go. An attacker can bypass CSRF token and Sec-Fetch-Site checks and...

Cross-site Request Forgery (CSRF)

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the MethodOverride middleware in middleware/methodoverride.go. An attacker can bypass CSRF token and Sec-Fetch-Site checks and...

CVE-2026-118266

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

DEBIAN-CVE-2026-118266

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

CVE-2026-118266

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

GHSA-R7W9-592Q-9VG4 Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Summary The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain e.Use, it rewrites the request...

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Summary The MethodOverride middleware accepts any non-empty string as the override target method — including safe methods GET, HEAD, OPTIONS, TRACE — when rewriting a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain e.Use, it rewrites the request...

CVE-2026-118266

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

CVE-2026-118266 Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...