CVE-2026-118266

The Echo Go web framework is vulnerable to a CSRF protection bypass in versions prior to 4.16.0 and 5.4.0 . The flaw exists because the MethodOverride middleware allows a POST request to be rewritten to a safe HTTP method. If MethodOverride is registered before CSRF middleware, the route selectio...

CVE-2026-118266 Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

DRUPAL-CONTRIB-2026-283

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently protect against cross-site request forgery CSRF on its toggle URL, under the scenario where a user...

DRUPAL-CONTRIB-2026-263

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. When redirecting to Stripe Connect to generate an authorization code, the module does not incorporate a CSRF token into the return URI. This could allow...

DRUPAL-CONTRIB-2026-258

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates. Routes for the inbox do not check for a CSRF token...

WordPress VikRentCar Car Rental Management System plugin <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution vulnerability

Cross-Site Request Forgery to Remote Code Execution vulnerability discovered by Wordfence PRISM in WordPress Plugin VikRentCar versions = 1.4.8...

EUVD-2026-111817

The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the saveprofilefields function that uses an isset condition at line 1119, allowing the security check to be completely...

CVE-2026-113486

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site...

CVE-2026-113485

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to...

CVE-2026-113486 Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site...

CVE-2026-113485

The Media Library Assistant WordPress plugin, in versions before 3.42 , is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists because the Media Library bulk-action handler fails to consistently validate its CSRF nonce, specifically checking the nonce only when the field is presen...

CVE-2026-113485 Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to...

CVE-2026-113486

The Media Library Assistant WordPress plugin, in versions before 3.42 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a failure to verify a CSRF nonce on the Empty Trash media action . This allows an attacker to trick a logged-in user with Editor permissions or hi...

EUVD-2026-111723

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to...

EUVD-2026-111724

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site...

SUSE CVE-2026-115917

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...

PT-2026-127841

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site...

PT-2026-127898

The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save profile fields function that uses an isset condition at line 1119, allowing the security check to be complete...

Commerce Stripe - Critical - Cross-site request forgery - SA-CONTRIB-2026-263

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. When redirecting to Stripe Connect to generate an authorization code, the module does not incorporate a CSRF token into the return URI. This could allow...

PT-2026-130597

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently protect against cross-site request forgery CSRF on its toggle URL, under the scenario where a user...