CVE-2026-57858

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

CVE-2026-47229

CVE-2026-47229 affects Admidio before 5.0.10. The code for SSO client state changes (/modules/sso/clients.php) does not validate a CSRF token in the enable path and accepts plain GET requests to toggle SAML/OIDC clients. An authenticated admin can be tricked into disabling or re-enabling a config...

CVE-2026-47229 Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no toke...

CVE-2026-47229 Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no toke...

CVE-2026-47229 Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no toke...

CVE-2026-47229

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no toke...

EUVD-2026-57206

Admidio is an open-source user management solution. Prior to version 5.0.10, modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no toke...

EUVD-2026-57205

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...

CVE-2026-47228 Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...

CVE-2026-47228 Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...

CVE-2026-47228

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...

CVE-2026-47228

CVE-2026-47228 (Admidio) : The registration flow in modules/registration.php, mode send_login, omits CSRF validation and accepts a GET request. This allows a registration-administrator to trigger a password reset for a target user by visiting a crafted URL, resulting in generating a new password,...

CVE-2026-47228 Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords

Admidio is an open-source user management solution. modules/registration.php mode sendlogin regenerates a random password for useruuidassigned, stores its bcrypt hash in admusers.usrpassword, and emails the cleartext to that user. Every other state-changing mode in the same file assignmember,...

CVE-2026-57858 Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

EUVD-2026-57195

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

CVE-2026-57858

CVE-2026-57858 affects Cal.com Cal.diy (versions 2.1.1–6.2.0). The stored XSS arises in BookingPageTagManager through an unsanitized analytics tracking ID, allowing an authenticated event owner to inject JavaScript that can run in visitors’ browsers. Reported impact includes potential session coo...

Exploit for CVE-2026-70376

CVE-2026-70376 — Pluck CMS Site-wide CSRF → RCE Fail-open Refere...

CVE-2026-48551: Cross-Site Request Forgery (CSRF)

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run command...

PT-2026-71319

Name of the Vulnerable Software and Affected Versions Astro versions 7.0.0 through 7.0.5 Description The composable astro/hono pipeline installs security.checkOrigin exclusively through the middleware primitive, whereas actions and pages can dispatch to user code independently. If actions are...

CVE-2026-73419: Insufficient Verification of Data Authenticity

NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value...