CVE-2026-19650 Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...

SUSE CVE-2026-48551

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

UBUNTU-CVE-2026-74999

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS...

EUVD-2026-60086

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

CVE-2026-74867 SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

CVE-2026-74867

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

WordPress Cookie Banner for GDPR / CCPA plugin <= 4.3.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'regionArray' Parameter vulnerability discovered by Naoya Takahashi nakko in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.5...

PT-2026-76603

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

CVE-2026-19650: Cross-Site Request Forgery (CSRF)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...

CVE-2026-74867: Cross-Site Request Forgery (CSRF)

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthoriz...

Gitlab -- Vulnerabilities

Gitlab reports: Code Injection issue via GraphQL directive impacts GitLab CE/EE Cross-Site Request Forgery issue in GraphQL multiplex query handler impacts GitLab CE/EE...

Joomla JCE_2.9.15 - Remote Code Execution

Exploit Title: Joomla JCE2.9.15 - Remote Code Execution Date: 2026-07-10 Exploit Author: K3ysTr0K3R Jared Brits Vendor Homepage: https://www.joomla.org/ Software Link: https://extensions.joomla.org/extension/jce/ Version: JCE 1.0.0 through 2.9.99.4 fixed in 2.9.99.5 Tested on: Joomla 3.10.11 / JC...

webpack_devserver 5.2.5 - CSRF

Exploit Title: webpackdevserver 5.2.5 - Csrf Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/webpack/webpack-dev-server Software Link: https://www.npmjs.com/package/webpack-dev-server Version: reaches launchEditorfileName from a CROSS-ORIGIN...

HakShop

HakShop — موقع تسوق متعمد فيه ثغرات للاختبار التعليمي فقط م...

EUVD-2026-59926

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2026-59924

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the top-level template code function. This makes it possible for...

CVE-2026-9767

The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15384

The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and...

EUVD-2026-59910

The Manual Image Crop WordPress plugin before 1.15 does not perform any capability check or nonce verification on the authenticated AJAX action that crops attachment images; its only guard passes for any logged-in user. A subscriber-level user can therefore supply an arbitrary attachment ID and...

CVE-2026-15384

The Manual Image Crop WordPress plugin (versions before 1.15 ) is vulnerable to an Insecure Direct Object Reference (IDOR) and Cross-Site Request Forgery (CSRF) . The flaw exists because the authenticated AJAX action used to crop attachment images fails to perform proper capability checks or nonc...