PT-2026-126351

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...

PT-2026-126335

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

Semantic MediaWiki authorization issue vulnerability

Versions of Semantic MediaWiki prior to 7.3.0 and 7.3.1 contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization validation in the smwtask API module. Unauthenticated attackers can use a public anonymous CSRF token to execute arbitrary task types without...

REDAXO CMS core authorization issue vulnerability

Versions of REDAXO CMS prior to 5.21.5 contain an authorization issue vulnerability. This vulnerability stems from a missing authorization check in the rexapipackage API function. Non-administrator backend users can manage packages by providing a valid CSRF token, which may result in uninstalling...

PT-2026-126358

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex api package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like...

REDAXO CMS core cross-site scripting vulnerability

REDAXO CMS core versions prior to 5.21.3 contain a cross-site scripting vulnerability. This flaw arises because the openerlink parameter on the backend media pool details page is not HTML-escaped, making it susceptible to reflected XSS attacks. Unauthenticated attackers can trick logged-in backen...

PT-2026-126635

Name of the Vulnerable Software and Affected Versions Newsletters versions prior to 4.18.3 Description Cross-Site Request Forgery CSRF occurs when a user is tricked into performing an action they did not intend to do. This issue is caused by missing or incorrect nonce validation on a function,...

CVE-2026-116748

Transmission versions 4.0.0 before 4.1.3 are affected by a permissive CORS vulnerability within the handle_request() function in rpc-server.cc. This flaw allows any web origin to access the X-Transmission-Session-Id anti-CSRF token from the 409 handshake response. An attacker can leverage this to...

CVE-2026-115917

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...

PYSEC-2026-4348

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...

PYSEC-2026-4348

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...

CVE-2026-115917

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowedorigins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...

CVE-2026-77058

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

EUVD-2026-109953

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

CVE-2026-77058 Cross-Site Request Forgery (CSRF) in boneIO

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

CVE-2026-77058

boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints. The root cause is the absence of CSRF tokens and a failure to validate Origin or Referer headers. A remote attacker can lure a user on the internal network to a malicious webpage that sends cross-...

CVE-2026-77058 Cross-Site Request Forgery (CSRF) in boneIO

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

CVE-2026-77058 Cross-Site Request Forgery (CSRF) in boneIO

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

CVE-2026-116210 Webasyst Framework through 4.4.0 Photos App CSRF via Backend Actions

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that...

CVE-2026-116210

The Webasyst Framework (through version 4.4.0 ) contains a cross-site request forgery (CSRF) vulnerability in its Photos app . The root cause is that the app fails to enable the framework's opt-in CSRF check. This allows remote attackers to lure authenticated users to a malicious page that submit...