CVE-2026-67363 Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

EUVD-2026-62396

Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...

CVE-2026-67363

The stripeCharges and payAuthorize endpoints in Balbooa Forms (versions before 2.4.3.2) accept the charge total from a client-controlled parameter without recomputing it from configured prices and lack authentication or CSRF checks. An unauthenticated attacker can purchase priced items for arbitr...

BIT-KIBANA-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

EUVD-2026-62209

Cross-Site Request Forgery CSRF vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0...

CVE-2026-66602 WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0...

CVE-2026-66602

Cross-Site Request Forgery CSRF vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0...

WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Brian Willows in WordPress Plugin HashBar – WordPress Notification Bar versions = 2.0.0...

CVE-2026-55593

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The...

CVE-2026-15571

A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC...

EUVD-2026-61222

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

CVE-2026-16732 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard closes the IP, CIDR, and custom-function...

CVE-2026-55593

Froxlor versions before 2.3.8 are vulnerable to CSRF: the standalone lib/ajax.php endpoint bypasses centralized validation in lib/init.php, and the editapikey action in Ajax::editApiKey modifies API key allowed_from/valid_until without a CSRF token. An attacker can forge requests via an authentic...

CVE-2026-55593 Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The...

EUVD-2026-61220

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The...

CVE-2026-68923

MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARECLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim...

CVE-2026-67921

Cross-Site Request Forgery CSRF vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code...

CVE-2026-61696

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

GHSA-3P54-567P-2WPR MobSF's CSRF checks not enforced after Django migration

Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...

MobSF's CSRF checks not enforced after Django migration

Summary Django's CsrfViewMiddleware exists only in the deprecated MIDDLEWARECLASSES ignored since Django 2.0. The active MIDDLEWARE tuple does not include it. All authenticated web POST endpoints delete scan, upload, download APK, change password, manage users accept requests without CSRF tokens...