CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via omission of the VerifyCsrfToken middleware in the global middleware stack. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into visiting a malicious...

CVE-2026-66416

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

Cross-site Request Forgery (CSRF)

Overview org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF...

CVE-2026-66416

Leantime 3.6.2 is affected by CVE-2026-66416 due to omission of the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. This CSRF protection gap enables unauthenticated attackers to perform state-changing actions that would otherwise require an authenticate...

SUSE CVE-2026-45327

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a ?password= query parameter, comparing the supplied...

SUSE CVE-2026-55883

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websockettoken endpoint and the upgrader accepts clients that omit an Origin...

CVE-2026-28813

Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue...

CVE-2026-44613

Apache Zeppelin (versions 0.6.0 through 0.12.0 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause lies in a default CORS configuration that permits cross-origin state-changing requests and accepts text/plain request bodies. Specifically, the CorsFilter, CorsUtils, and RES...

CVE-2026-44613

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-5219

CVE-2026-5219 is a CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack affecting versions up to 30072026. The issue allows an attacker to perform unauthorized actions with network access (attack vector: network) and requires user interaction, with CVSS 3.1 base scor...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

PT-2026-66472

Name of the Vulnerable Software and Affected Versions E-Commerce Pack versions prior to 5.03.01.49 Description A Cross-Site Request Forgery CSRF flaw exists in the software. CSRF is a type of attack that tricks a victim into submitting a malicious request. It allows an attacker to perform...

CVE-2026-17936: Cross-Site Request Forgery (CSRF)

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-14239: Improper Neutralization of Input During Web Page Generation

The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...

CVE-2026-44613: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a malicious site to perform actions on the...

CVE-2026-66416: Cross-Site Request Forgery (CSRF)

Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can...

CVE-2026-28813: Cross-Site Request Forgery (CSRF)

Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue...

CVE-2026-5219: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49...

CVE-2026-5582: Cross-Site Request Forgery (CSRF)

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...