CVE-2025-13394

The CVE-2025-13394 entry describes a CSRF issue in the Carbon console's Ajax processor. State-changing operations are performed via HTTP GET, and while SameSite=Lax cookies are used, this mitigation is bypassed for cross-origin top-level navigation, allowing an authenticated user’s browser to tri...