67881 matches found
io.quarkiverse.renarde:quarkus-renarde (>=3.0.13, <=3.0.20), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.0.13, <=3.0.20) +14 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.9.0.cr1, <=3.20.6.1)
io.quarkus:quarkus-rest-csrf MAVEN version =3.9.0.cr1, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.20 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...
io.quarkiverse.renarde:quarkus-renarde (>=3.1.4, <=3.1.6), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.4, <=3.1.6) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.28.0.cr1, <=3.33.2)
io.quarkus:quarkus-rest-csrf MAVEN version =3.28.0.cr1, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.28.0.cr1, =3.33.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...
io.quarkiverse.renarde:quarkus-renarde (>=3.1.0, <=3.1.3), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.0, <=3.1.3) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.21.0.cr1, <=3.27.4)
io.quarkus:quarkus-rest-csrf MAVEN version =3.21.0.cr1, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.21.0.cr1, =3.27.4 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...
📄 CMS SINDEHOTÉIS 1.2.4 Cross Site Request Forgery
CMS SINDEHOT�IS version 1.2.4 suffers from a cross site request forgery vulnerability. ================================================================================================================================== | Title : CMS SINDEHOTÉIS 1.2.4 CSRF | | Author : indoushka | | Tested on :...
Path Equivalence
Overview Affected versions of this package are vulnerable to Path Equivalence in the pathWithoutMatrixParams of AbstractPathMatchingHttpSecurityPolicy via specially crafted HTTP requests containing encoded semicolons, slashes, or backslashes in the request path. An attacker can gain unauthorized...
CVE-2026-9591: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to /api/news-items, due to missing anti-CSRF protection...
WordPress Theme: niveau: CVE-2024-34810: Cross-Site Request Forgery (CSRF)
Cross-Site request forgery CSRF vulnerability in Extend Themes Skyline WP allows Cross Site Request Forgery. This issue affects Skyline WP: from n/a through 1.0.10...
Server-side Request Forgery (SSRF)
Overview @lobehub/lobehub is a LobeHub - an open-source,comprehensive AI Agent framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application. Affected versions of this package are...
CVE-2026-49043 WordPress WP Migrate Lite plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in WP Migrate Lite = 2.7.8 versions...
React Router: Potential CSRF via PUT/PATCH/DELETE document requests
Certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight, SameSite cookies already block the cross-origin attack vectors...
CVE-2026-48518 MultiJuicer: Login CSRF allows attacker to force victims into their team
MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint POST /multi-juicer/api/teams/team/join accepted requests with any Content-Type, including text/plain. Because tha...
CVE-2016-20083 WordPress More Fields Plugin 2.1 Cross-Site Request Forgery
WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxe...
CVE-2016-20074 WordPress Lazy Content Slider Plugin 3.4 CSRF
WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via...
PT-2026-49578
Name of the Vulnerable Software and Affected Versions React Router version 7 Description Insufficient Cross-Site Request Forgery CSRF checks in Framework Mode allow bypasses when using 'PUT', 'PATCH', or 'DELETE' requests, as the checks were primarily applied to 'POST' requests. CSRF is a type of...
CVE-2026-49043: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in WP Migrate Lite = 2.7.8 versions...
CVE-2016-20067: Cross-Site Request Forgery (CSRF)
WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML pages that execute unwanted poll operations when administrators visit the page while logged in...
CVE-2016-20083: Cross-Site Request Forgery (CSRF)
WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxe...
CVE-2016-20074: Cross-Site Request Forgery (CSRF)
WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via...
CVE-2026-48518: Cross-Site Request Forgery (CSRF)
MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint POST /multi-juicer/api/teams/team/join accepted requests with any Content-Type, including text/plain. Because tha...
