CVE-2026-54642

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

CVE-2026-54642 CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

CVE-2026-54642

CubeCart (ecommerce software) versions prior to 6.7.5 contain a CSRF vulnerability in the admin panel. The reset_id (download-counter reset) and delete_card (stored payment-card deletion) actions in admin/sources/orders.index.inc.php use state-changing GET requests that are omitted from the CSRF ...

CVE-2026-54642 CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

EUVD-2026-82530

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

CVE-2026-54642 CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, the resetid download-counter action and deletecard stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote...

CVE-2026-54510

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrfexemptforapitokens beforerequest hook in src/app.py calls csrf.exemptviewfunc, permanently adding the selected view to Flask-WTF's process-global exemption set. The...

EUVD-2026-65215

Grav: Non constant time nonce comparison in Utils::verifyNonce used for CSRF protection...

GHSA-38P6-H87P-R4CG Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Summary Grav\Common\Utils::verifyNonce, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's === operator instead of hashequals. === on strings short circuits at the first differing byte, so the comparison time leaks how...

Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Summary Grav\Common\Utils::verifyNonce, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's === operator instead of hashequals. === on strings short circuits at the first differing byte, so the comparison time leaks how...

CVE-2026-54510 Speakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrfexemptforapitokens beforerequest hook in src/app.py calls csrf.exemptviewfunc, permanently adding the selected view to Flask-WTF's process-global exemption set. The...

CVE-2026-54510

Speakr is a self-hosted web application for transcribing audio recordings. Prior to 0.8.21-alpha , the csrf_exempt_for_api_tokens() before_request hook in src/app.py calls csrf.exempt(view_func), permanently adding a view to Flask-WTF's process-global exemption set. The is_token_authenticated() f...

EUVD-2026-82427

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrfexemptforapitokens beforerequest hook in src/app.py calls csrf.exemptviewfunc, permanently adding the selected view to Flask-WTF's process-global exemption set. The...

CVE-2026-54510 Speakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrfexemptforapitokens beforerequest hook in src/app.py calls csrf.exemptviewfunc, permanently adding the selected view to Flask-WTF's process-global exemption set. The...

CVE-2026-54510 Speakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrfexemptforapitokens beforerequest hook in src/app.py calls csrf.exemptviewfunc, permanently adding the selected view to Flask-WTF's process-global exemption set. The...

CVE-2026-78295

Unauthenticated Cross Site Request Forgery CSRF in Xagio SEO = 7.1.0.43 versions...

CVE-2026-80355

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery CSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-74005

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Series = 3.1.3 versions...

CVE-2026-66571

Unauthenticated Cross Site Request Forgery CSRF in Asset CleanUp: Page Speed Booster = 1.4.0.5 versions...

CVE-2026-80355

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery CSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...