CVE-2026-52823 Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...

CVE-2026-52823 Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...

CVE-2026-52823

Kimai , an open-source time tracking application, contains an authenticated CSRF vulnerability in its TimesheetController (src/API/TimesheetController.php). Prior to version 2.58.0 , the stop and restart operations were exposed as GET requests without a request-forgery defense, while reusing the ...

CVE-2026-57139

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest without authentication or authorization. Any network client that can reach the port can...

CVE-2026-91857

Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures - NoticelistsController::enableNoticelist - ServersController::removeOrphanedCorrelations -...

CVE-2026-44202

OpenAM (Open Identity Platform), an open-source IAM platform derived from ForgeRock, has an authenticated SSRF vulnerability in the /sessionservice addSessionListener operation. Prior to 16.1.1 , an authenticated user can register an arbitrary notification URL without requiring an administrative ...

CVE-2026-45052

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the Liberty Web Services SOAP receiver permits unauthenticated remote requests to write persistent entries through SOAPReceiver and DiscoveryService into a user's Liberty Discovery store and the shared root-realm...

CVE-2026-91857 MISP: State-changing actions accessible via GET request enabling CSRF

Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures - NoticelistsController::enableNoticelist - ServersController::removeOrphanedCorrelations -...

CVE-2026-91857 MISP: State-changing actions accessible via GET request enabling CSRF

Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: - EventReportsController::purgeUnusedPictures - NoticelistsController::enableNoticelist - ServersController::removeOrphanedCorrelations -...

CVE-2026-91819

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed WebSphere Application Server is affected by an HTTP request smuggling vulnerability (CVE-2026-11710)

Summary The security issue described in CVE-2026-11710 has been identified in WebSphere Application Server included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affecte...

CVE-2026-91819

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

Exploit for Improper Input Validation in Apache Tomcat

CVE-2026-24733 What is CVE-2026-24733? Apache Tomcat incor...

Exploit for Improper Access Control in Widgetfactorylimited Jce

E.L.V CVE Research & Assessment Framework E.L.V — Exploit...

CVE-2026-15789

A flaw was found in BuildKit. A custom client with valid permissions to access the BuildKit control API can produce an upload request that allows files to escape from the BuildKit-controlled state directory. This could lead to unauthorized modification or disclosure of sensitive data...

SUSE CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

Chromium CVE-2026-87449: Cross-site request forgery in DeviceBoundSessionCredentials

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

EUVD-2026-78206

Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations...

EUVD-2026-78164

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

PT-2026-93190

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan config set cgi, wan num set cgi, and lan ip change cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network...