CVE-2026-19786: Cross-Site Request Forgery (CSRF)

A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressin...

PT-2026-71953

A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressin...

CVE-2026-19636: Generation of Incorrect Security Tokens

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

PT-2026-72115

Name of the Vulnerable Software and Affected Versions iCagenda versions prior to 2.0.0-4.0.11 Description Multiple state changing operations in the frontend are callable without a Cross-Site Request Forgery CSRF token check. CSRF is a type of attack that tricks a victim into submitting a maliciou...

PT-2026-72060

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...

PT-2026-75964

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

UBUNTU-CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

PT-2026-76567

Summary Description An Insecure Default Initialization of Resource CWE-1188 issue in the OpenAM default configuration ships the iPlanetDirectoryPro SSO cookie with HttpOnly=false. Also, the iPlanetDirectoryPro SSO cookie is used as a CSRF token in OAuth/OIDC flows. This affects OpenAM Community...

CVE-2026-57469: Cross-Site Request Forgery (CSRF)

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

pgadmin4-9.17-1.1 on GA media (moderate)

pgadmin4-9.17-1.1 on GA media Announcement ID: openSUSE-SU-2026:11508-1 Rating: moderate Cross-References: CVE-2026-12044 CVE-2026-12045 CVE-2026-12046 CVE-2026-12047 CVE-2026-12048 CVE-2026-12049 CVE-2026-12050 CVE-2026-1707 CVE-2026-17347 CVE-2026-17349 CVE-2026-17350 CVE-2026-17351...

CVE-2026-72849

Budibase before 3.40.0 is affected by a cross-site request forgery in the chat-link handoff endpoint. The underlying issue allows an attacker to bind an external chat identity to a victim’s account via a phishing page that auto-submits a POST with a leaked confirmation token, enabling impersonati...

CVE-2026-72849 Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-72849

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-73426 vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.3-rails, ruby3.4-rails, ruby3.2-rails...

CVE-2026-17069

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-13365

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2026-17069 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-17069 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

EUVD-2026-58389

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-17069

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...