PT-2026-130587

This module enables you to use the Stripe Connect API to quickly configure your Drupal Commerce store to take payments via multiple Stripe APIs. When redirecting to Stripe Connect to generate an authorization code, the module does not incorporate a CSRF token into the return URI. This could allow...

CVE-2026-113486: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action,…

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site...

Fasttoggle - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-283

This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently protect against cross-site request forgery CSRF on its toggle URL, under the scenario where a user...

PT-2026-130573

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates. Routes for the inbox do not check for a CSRF token...

CVE-2026-118266: Cross-Site Request Forgery (CSRF)

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POS...

Commerce Core - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-258

This module enables you to sell goods and services to customers through a shopping cart and checkout form. It shows an inbox on the Commerce dashboard with announcements from the Drupal Commerce project, including notices about security updates. Routes for the inbox do not check for a CSRF token...

PT-2026-127840

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to...

CVE-2026-113485: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media…

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to...

CVE-2026-116863

Cross-Site Request Forgery CSRF vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2...

CVE-2026-116863

The WordPress Newsletters plugin (newsletters-lite ) by Tribulant Software is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) in versions up to and including 4.18.2 . This flaw allows an attacker to perform unauthorized actions on behalf of a victim. The impact is rated ...

CVE-2026-116863 WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2...

CVE-2026-116863 WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2...

EUVD-2026-111144

Cross-Site Request Forgery CSRF vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2...

WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by wackydawg in WordPress Plugin Newsletters versions = 4.18.2...

OPENSUSE-SU-2026:22195-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: Changes in roundcubemail: Update to 1.6.20: This is a security update to the version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: + Fix IMAP command injection via CRLF in uid parameter of...

CVE-2026-117535

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the openerlink parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The...

CVE-2026-116893

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rexapipackage API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like...

CVE-2026-116890

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...

CVE-2026-116874

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-117536 REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page users/users because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNCUPDATE does not require it. Attackers can lure a logged-in...