CVE-2026-62062 WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

EUVD-2026-86532

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

CVE-2026-62062

The Elementor Website Builder and Elementor Pro (versions 4.3.0 through 4.3.1 ) are vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352). The root cause is that the software skips WordPress REST API nonce validation when the REQUEST_URI contains elementor/v1/events/. Specific...

CVE-2026-62062 WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

WordPress Elementor Website Builder plugin 4.3.0-4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Sakri Koskimies in WordPress Plugin Elementor Website Builder versions 4.3.0-4.3.1...

CVE-2026-85289: Cross-Site Request Forgery (CSRF)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits ensurevalidpostrequest from delete methods including Payments::delete, Recurring::delete, and Userclients::delete. Although the routes require POST, they do not...

Linux Distros Unpatched Vulnerability : CVE-2026-57177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the...

CVE-2026-86066: Cross-Site Request Forgery (CSRF)

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

CVE-2026-49850: Improper Limitation of a Pathname to a Restricted Directory

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete and Invoices::deleteinvoicetax as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator...

PT-2026-98879

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane exposes the delete and delete invoice tax functions within the Invoices module as state-changing routes that do not require a POST request or CSRF Cross-Site Request Forgery token...

Adobe Experience Manager Forms JEE <= 6.5.25 / 6.5 LTS SP2 Multiple Vulnerabilities (APSB26-151)

The version of Adobe Experience Manager Forms JEE installed on the remote host is 6.5.25 or earlier, or 6.5 LTS SP2 or earlier. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-151 advisory. - Adobe Experience Manager Forms JEE is affected by an Incorrect...

CVE-2026-62062: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

VulnCheck KEV: CVE-2026-62062

Cross-Site Request Forgery CSRF vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1...

PT-2026-98356

Name of the Vulnerable Software and Affected Versions Elementor Website Builder versions 4.3.0 through 4.3.1 Elementor Pro versions 4.3.0 through 4.3.1 Description A Cross-Site Request Forgery CSRF flaw exists where a logged-in administrator can be tricked into opening a crafted link, leading to...

Mattermost Server 11.7.x < 11.7.11 / 11.8.x < 11.8.6 / 11.9.x < 11.9.2 / 11.10.x < 11.10.2 Multiple Vulnerabilities (MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00771, MMSA-2026-00775, MMSA-2026-00776 advisories. - Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a...

PT-2026-98337

Name of the Vulnerable Software and Affected Versions ningzichun student-management-system versions prior to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Description A flaw in an unknown function allows remote attackers to perform a manipulation that results in cross-site request forgery, a type of...

CVE-2026-97648: Cross-Site Request Forgery (CSRF)

A vulnerability was detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function. Performing a manipulation results in cross-site request forgery. It is possible to initiate the attack remotely. The exploit is now public and may ...

CVE-2026-85274: Cross-Site Request Forgery (CSRF)

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Recurring::stop as a state-changing GET route without CSRF token validation. When an authenticated administrator loads attacker-controlled content that requests...

PT-2026-98883

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane exposes the Recurring::stop function as a state-changing GET route that lacks Cross-Site Request Forgery CSRF token validation. CSRF is a type of attack that tricks a victim into...

PT-2026-98884

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to validate Cross-Site Request Forgery CSRF tokens in several delete methods. Specifically, the ensure valid post request function is omitted from Payments::delete,...