67650 matches found
CVE-2026-84663
A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...
CVE-2026-84649
In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...
CVE-2026-84663
A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...
CVE-2026-84663
The Jenkins Pipeline: Groovy Libraries Plugin (also identified as pipeline-groovy-lib) version 798.v5cc688825312 and earlier is vulnerable to a cross-site request forgery (CSRF) . The root cause is that the plugin does not require POST requests for a specific HTTP endpoint, which allows an attack...
EUVD-2026-70129
A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...
CVE-2026-84663
A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...
EUVD-2026-70115
In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...
CVE-2026-84649
The Stapler component (versions 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317, excluding 2088.2093.vd7c3e58008a_6) included in Jenkins versions 2.447 through 2.579 and LTS 2.452.1 through 2.568.2 contains a vulnerability where an HTTP endpoint serving dynamically generated JavaScript resource...
CVE-2026-84649
In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...
CVE-2026-84649
In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...
CVE-2026-8151
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...
EUVD-2026-61222
fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count...
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...
Cross-site Request Forgery (CSRF)
Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the netmount process. An attacker can force the application to mount an attacker-controlled FTP endpoin...
EUVD-2026-68772
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections...
GHSA-9HJF-W35W-6VX2 elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
Summary The PHP connector's CSRF gate protects many mutating commands, but it does not protect the netmount connector command. In the shipped minimal connector setup, FTP network mounting is enabled by default, so a cross-site request can force an elFinder instance to mount an attacker-chosen FTP...
CVE-2026-8151 Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...
CVE-2026-8151
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 lacks CSRF protection on its settings page. An attacker can craft a request that, when submitted by a logged-in administrator , silently replaces the configured MailChimp API key. Once swapped, all subsequent member registr...
EUVD-2026-70043
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...