PT-2026-77063

Name of the Vulnerable Software and Affected Versions Slider by 10Web versions prior to 1.2.63 Description An unauthenticated Cross Site Request Forgery CSRF issue exists, which allows an attacker to force an authenticated user to execute unwanted actions on the web application. Recommendations...

PT-2026-77267

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback messagemessage is stored without sanitization and rendered in app/views/admin/feedback messages/ feedback message.html.erb throu...

CVE-2026-67921

A critical Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 . The flaw is caused by a combination of a misconfigured CORS policy in CorsConfigurer.java (allowing * origins with credentials: true) and a CSRF protection bypass in CsrfConfigurer.java, where AP...

PT-2026-76905

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

CVE-2026-68923: Cross-Site Request Forgery (CSRF)

MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARECLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim...

CVE-2026-67921: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...

PT-2026-77244

Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.5.1 Description In the settings.py file, the django.middleware.csrf.CsrfViewMiddleware is placed only in the deprecated MIDDLEWARE CLASSES setting and omitted from the active MIDDLEWARE tuple. This configuration error...

GitLab EE/CE Git Manipulation Code Execution

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE relates to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted GET requests...

FreeBSD : Gitlab -- Vulnerabilities (3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3a65fb7e-9ac2-11f1-bdc8-2cf05da270f3 advisory. Gitlab reports: Code Injection issue via GraphQL directive impacts GitLab CE/EE Cross-Site...

PT-2026-77311

Name of the Vulnerable Software and Affected Versions fastify versions 5.8.3 through 5.12.0 Description An issue exists in the handling of forwarded-header reads used to derive request host, protocol, hostname, ip, and ips values. When the trustProxy setting is configured with a numeric hop-count...

CVE-2026-45126: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET...

CVE-2026-45128: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named...

PT-2026-77181

MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set...

PT-2026-80212

Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARE CLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...

CVE-2026-55593: Cross-Site Request Forgery (CSRF)

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The...

PT-2026-77310

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the legacy client-initiated account-linking endpoint of Keycloak. The protection mechanism for the account-linking process uses a predictable hash, which a malicious OpenID...

PT-2026-77319

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The...

CVE-2026-16732: Use of Less Trusted Source

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

CVE-2026-67921

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...

CVE-2026-45119: Cross-Site Request Forgery (CSRF)

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in...