EUVD-2026-109715

Cross-Site Request Forgery CSRF vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42...

CVE-2026-97295 WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42...

CVE-2026-97295

The David Lingren Media Library Assistant WordPress plugin (version 3.42 and below ) is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions on behalf of a logged-in user. The CVSS v3.1 score is 4.3 (Medium) , with a network...

CVE-2026-97295 WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42...

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by yzx001 in WordPress Plugin Media LIbrary Assistant versions = 3.42...

CVE-2026-111841

Cross-Site Request Forgery CSRF vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...

CVE-2026-111841 WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...

CVE-2026-111841

The Aman FunnelKit Automations (wp-marketing-automations) WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. This vulnerability impacts versions from n/a through 3.8.5.2 . An attacker could potentially perform unauthorized actions by tricking an authenticated user into ma...

EUVD-2026-109674

Cross-Site Request Forgery CSRF vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...

CVE-2026-111841 WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...

WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by AndrewN in WordPress Plugin FunnelKit Automations versions = 3.8.5.2...

CVE-2026-116194

A flaw was found in rclone. A remote attacker could redirect file transfers and expose sensitive data by exploiting a Cross-Site Request Forgery CSRF vulnerability in the pCloud storage backend. During authorization, the local authentication callback service fails to validate the session state an...

PT-2026-132751

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on...

PT-2026-125027

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.32.0 Description The OpenAI-compatible server in this inference engine for large language models configures Starlette CORSMiddleware with allowed origins set to a wildcard by default. This allows a malicious web page t...

boneIO Black cross-site request forgery vulnerability

In boneIO Black versions 1.2.0 through 1.6.0, there is a cross-site request forgery vulnerability. This vulnerability arises because all API endpoints that modify state lack CSRF tokens and do not validate the Origin or Referer headers. As a result, remote attackers can craft malicious web pages...

PT-2026-123258

Cross-Site Request Forgery CSRF vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42...

PT-2026-123363

boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...

PT-2026-123201

Cross-Site Request Forgery CSRF vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the despam.php action handler, which processes destructive page-deletion and revision-restore operations submitted via POST without validating a CSRF token. An attacker can plant a wiki page containin...

CVE-2026-116204

YesWiki versions prior to 4.7.0 are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within the despam action (tools/security/actions/despam.php). This flaw allows unauthenticated attackers to perform unauthorized actions, such as deleting or restoring pages, by tricking an authent...