CVE-2026-88872

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in the setPassword.json.php endpoint due to missing CSRF token validation. An unauthenticated attacker can craft a malicious webpage that, when visited by an authenticated adm...

CVE-2026-88872 AVideo CustomizeUser setPassword.json.php CSRF

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage tha...

CVE-2026-88871 WWBN AVideo CustomizeUser setSubscribers CSRF via GET

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...

CVE-2026-88871 WWBN AVideo CustomizeUser setSubscribers CSRF via GET

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...

CVE-2026-88871

WWBN AVideo 's CustomizeUser plugin (enabled by default) contains a CSRF vulnerability in the setSubscribers.json.php endpoint, affected through commit c3edcc274c (master, 2026-08-23). The endpoint reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without re...

CVE-2026-88870 WWBN AVideo LoginControl PGP Key CSRF via GET Request

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a...

CVE-2026-88870

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery (CSRF) vulnerability in the LoginControl plugin PGP key endpoints. The affected endpoints, including savePublicKey.json.php , lack CSRF token validation and accept requests via GET. An attack...

PYSEC-2026-3882 piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Summary piccoloadmin uses a helper called superuservalidators to gate access to the user and session tables for non-superusers. The helper rejects PUT, PATCH, DELETE, and POST, but does not reject GET. The sessions table stores live session tokens in plaintext, and the token column is not marked...

piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Summarypiccoloadmin uses a helper called superuservalidators to gate access to the user and session tables for non-superusers. The helper rejects PUT, PATCH, DELETE, and POST, but does not reject GET.The sessions table stores live session tokens in plaintext, and the token column is not marked...

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

SummaryAdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request.If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's G...

PYSEC-2026-3828 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

PT-2026-102347

Name of the Vulnerable Software and Affected Versions PyJWT versions prior to 2.14.0 Description The get signing key from jwt function is affected by a flaw where unknown kid Key ID values trigger forced refreshes of the JSON Web Key Set JWKS without a negative cache or minimum refresh interval...

CVE-2026-88873: Cross-Site Request Forgery (CSRF)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious...

PT-2026-89384

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious...

PT-2026-89383

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage tha...

PT-2026-89382

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads users id and ExtraSubscribers from $ REQUEST and calls...

CVE-2026-88872: Cross-Site Request Forgery (CSRF)

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage tha...

CVE-2026-79324

Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 mageplaza/module-gdpr through 4.2.9 allows remote unauthenticated attackers to delete any customer's saved address, and to erase all stored addresses by iterating the address id, via a GET request to...

Information Exposure

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Information Exposure in the GET /hardware/requested endpoint when Full Multiple Company Support is enabled. An attacker can access sensitive information belonging to other...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization in the GET /api/v1/hardware//assigned/components endpoint, which does not properly enforce the required permission check. An attacker can access...