CVE-2026-111401

Cross-Site Request Forgery CSRF vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3...

EUVD-2026-107467

Cross-Site Request Forgery CSRF vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3...

CVE-2026-111401 WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3...

CVE-2026-111401

The Tailored Tools WordPress plugin (versions

CVE-2026-111401 WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3...

WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Oly Hossen in WordPress Plugin Tailored Tools versions = 3.0.3...

DRUPAL-CONTRIB-2026-240

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery CSRF. An attacker could trick an editor into visiting a crafted link, which...

CVE-2026-113796

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-113796

The Electron framework (prior to versions 42.11.3 , 43.7.0 , 44.3.0 , and 45.0.0-alpha.6 ) fails to correctly apply SameSite cookie restrictions when opening new windows via links. The framework incorrectly treats these as application-initiated navigations rather than preserving the initiating pa...

CVE-2026-113796

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

CVE-2026-114470

Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to a Cross-Site Request Forgery (CSRF) in the REST API . The root cause is that while the API protects cookie-based sessions, it does not apply the same protections to HTTP Basic authentication . Because browsers cache Basi...

CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

CVE-2026-86611

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its...

CVE-2026-86611

The Download Manager WordPress plugin (Free & Pro) versions before 3.3.71 and before 7.5.9 are vulnerable to a Cross-Site Request Forgery (CSRF) . The root cause is a lack of CSRF checks in specific locations, which allows an attacker to trick a logged-in administrator into updating the plugin's ...

EUVD-2026-107085

The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its...