EUVD-2026-76691

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

CVE-2026-81907

Concrete CMS version 9.5.2 and below is vulnerable to a Cross-Site Request Forgery (CSRF) flaw within the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries). The root cause is that the controller records but fails to enforce a failed CSRF token che...

CVE-2026-81907 Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/deleteentries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation t...

CVE-2026-68526

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

CVE-2026-68526 Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

CVE-2026-68526 Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

EUVD-2026-76246

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

CVE-2026-68526 Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller

Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller concrete/controllers/dialog/event/duplicate.php submit action, which duplicated a calendar event after checking only canAccess and the per-resource canAddCalendarEvent permission, so a...

CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-81912

Concrete CMS before 9.5.3 contains a Cross-Site Request Forgery (CSRF) flaw in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved selected group tree nodes without validating an action token, allowing a state-changing group move to be processed agains...

CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-62139

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

CVE-2026-62133

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

EUVD-2026-76198

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

CVE-2026-62139

Site Kit by Google (WordPress plugin, versions

CVE-2026-62139 WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

EUVD-2026-76204

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

CVE-2026-72709 SPIP < 4.4.18 Missing Authorization via ecrire/action/

SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to invoke privileged actions by supplying only a valid CSRF nonce without any server-side permission check. Attackers can bypass template-level...

CVE-2026-89245

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...

CVE-2026-89148

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint is not a .json.php script, AVideo's automatic CSRF guard autoCSRFGuard/forbidIfIsUntrustedRequest does not run, and when the request includes the sort paramet...