CVE-2026-55742 Cotonti CSRF in admin.rights.php allows privilege escalation

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action 'a=update' modifies group access rights including via cotauthaddgroup without calling cotcheckxg to validate th...

CVE-2026-55741 Cotonti CSRF in admin.config.php allows unauthorized configuration changes

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action 'a=update' processes POST data via cotconfigupdateoptions without calling cotcheckxg to validate...

CVE-2026-55741 Cotonti CSRF in admin.config.php allows unauthorized configuration changes

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action 'a=update' processes POST data via cotconfigupdateoptions without calling cotcheckxg to validate...

CVE-2026-11784

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replacefile function. This makes it...

CVE-2026-55744: Cross-Site Request Forgery (CSRF)

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the Personal File Storage PFS module. In modules/pfs/inc/pfs.main.php, the file upload action 'a=upload' processes uploaded files without calling cotcheckxg to validate the anti-CSRF token, even though...

CVE-2026-54220: Cross-Site Request Forgery (CSRF)

uBB.threads is vulnerable to a Cross-Site Request Forgery CSRF due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user into executing unintended actions. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version...

CVE-2026-55741: Cross-Site Request Forgery (CSRF)

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the administration configuration handler. In system/admin/admin.config.php, the configuration update action 'a=update' processes POST data via cotconfigupdateoptions without calling cotcheckxg to validate...

CVE-2026-11784: Cross-Site Request Forgery (CSRF)

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replacefile function. This makes it...

CVE-2026-56024: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue affects WP EasyPay: from n/a through 4.5.0...

CVE-2026-55745: Cross-Site Request Forgery (CSRF)

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the Personal File Storage PFS module. In modules/pfs/inc/pfs.editfolder.php, the folder update action 'a=update' updates folder metadata title, description, public/gallery flags without calling cotcheckxg ...

CVE-2026-55742: Cross-Site Request Forgery (CSRF)

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action 'a=update' modifies group access rights including via cotauthaddgroup without calling cotcheckxg to validate th...

PT-2026-50669

uBB.threads is vulnerable to a Cross-Site Request Forgery CSRF due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user into executing unintended actions. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version...

CVE-2026-9591

CVE-2026-9591 documents a CSRF vulnerability in the SimplCommerce News module. The issue is in the NewsItemApiController and allows an unauthenticated remote attacker to create or modify news items as an administrator by submitting a crafted form to /api/news-items, due to missing anti-CSRF prote...

CVE-2026-22342: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in WordPress Dating Theme = 11.2.0 versions...

WordPress Plugin: emergency-password-reset: CVE-2024-35648: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in Andy Moyle Emergency Password Reset allows Cross Site Request Forgery. This issue affects Emergency Password Reset: from n/a through 8.0...

WordPress Theme: niveau: CVE-2024-34810: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery. This issue affects Skyline WP: from n/a through 1.0.10...

io.quarkiverse.renarde:quarkus-renarde (>=3.1.7, <=3.1.10), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.7, <=3.1.10) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.34.0.cr1, <=3.36.2)

io.quarkus:quarkus-rest-csrf MAVEN version =3.34.0.cr1, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.34.0.cr1, =3.36.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

io.quarkus:quarkus-rest-csrf-deployment (3.37.0.cr1) potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (3.37.0.cr1)

io.quarkus:quarkus-rest-csrf MAVEN version 3.37.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-rest-csrf and may be impacted: - io.quarkus:quarkus-rest-csrf-deployment 3.37.0.cr1 Source cves: CVE-2026-50559 Source advisory:...

io.quarkiverse.renarde:quarkus-renarde (>=3.0.13, <=3.0.20), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.0.13, <=3.0.20) +14 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.9.0.cr1, <=3.20.6.1)

io.quarkus:quarkus-rest-csrf MAVEN version =3.9.0.cr1, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.20 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

io.quarkiverse.renarde:quarkus-renarde (>=3.1.4, <=3.1.6), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.4, <=3.1.6) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-rest-csrf MAVEN version =3.28.0.cr1, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.28.0.cr1, =3.33.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...