CVE-2026-66652: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1...

CVE-2026-84649: Cross-Site Request Forgery (CSRF)

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

CVE-2026-84663: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches...

CVE-2026-84764: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

PT-2026-84700

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

PT-2026-84682

Name of the Vulnerable Software and Affected Versions ThemeGoods Grand Tour versions prior to 5.5.2 Description A Cross-Site Request Forgery CSRF flaw exists in the ThemeGoods Grand Tour theme. This issue allows an attacker to induce a victim into performing unwanted actions on the affected syste...

PT-2026-84697

Name of the Vulnerable Software and Affected Versions Activity Log versions prior to 2.13.2 Description An unauthenticated Cross Site Request Forgery CSRF issue exists. CSRF is a flaw that allows an attacker to trick a victim into performing actions they did not intend to do on a web application...

CVE-2026-8151: Cross-Site Request Forgery (CSRF)

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

PT-2026-84699

Unauthenticated Cross Site Request Forgery CSRF in Simply Schedule Appointments = 1.6.12.23 versions...

CVE-2026-84759: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...

PT-2026-84746

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data name, email,...

PT-2026-84633

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

PT-2026-84772

In Stapler 1839.ved17667b a eb 5 through 2107.v8dfcb e8ed317 both inclusive, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

CSRF vulnerability in pipeline-groovy-lib

pipeline-groovy-lib 798.v5cc688825312 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete shared library caches. pipeline-groovy-lib 805.vafc79344957d requires POST requests fo...

Cross-origin exposure of CSRF token

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler provides an HTTP endpoint serving dynamically generated JavaScript resources. In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6,...

CVE-2026-81432: Cross-Site Request Forgery (CSRF)

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the editposts capability Contributor and above delete or modify custom widget skins via a crafted request, provided they can...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory 2026-09-02: High SECURITY-3972 / CVE-2026-84645: Deserialization vulnerability Medium SECURITY-3908 / CVE-2026-84646: Lack of type restriction in deserialization High SECURITY-3915 / CVE-2026-84647: Instantiation of any types related to configuration High SECURITY-3967 /...

Jenkins LTS < 2.568.3 / Jenkins weekly < 2.580 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.568.3 or Jenkins weekly prior to 2.580. It is, therefore, affected by multiple vulnerabilities: - In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient...

CVE-2026-84482

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the getdomain and isSameDomain functions that fail to properly validate referer origins. Attackers can forge requests from sibling subdomains or unparseable long-gTLD origins to perform administrative...

CVE-2026-84482

WWBN AVideo (through commit 9c39d8c8) contains a cross-site request forgery (CSRF) vulnerability in the get_domain() and isSameDomain() functions, which fail to properly validate referer origins. An attacker can forge requests from sibling subdomains or unparseable long-gTLD origins to perform ad...