CVE-2026-84649

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

EUVD-2026-70115

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

CVE-2026-84649

The Stapler component (versions 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317, excluding 2088.2093.vd7c3e58008a_6) included in Jenkins versions 2.447 through 2.579 and LTS 2.452.1 through 2.568.2 contains a vulnerability where an HTTP endpoint serving dynamically generated JavaScript resource...

CVE-2026-84649

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

PT-2026-84772

In Stapler 1839.ved17667b a eb 5 through 2107.v8dfcb e8ed317 both inclusive, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

CVE-2026-84649: Cross-Site Request Forgery (CSRF)

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

Cross-site Request Forgery (CSRF)

Overview org.apache.wicket:wicket-core is a Java web application framework that takes simplicity, separation of concerns and ease of development to a whole new level. Wicket pages can be mocked up, previewed and later revised using standard WYSIWYG HTML design tools. Dynamic content processing an...

CVE-2026-71378

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...

CVE-2026-71378

The Apache Wicket framework (specifically wicket-core) is vulnerable to Cross-Site Request Forgery (CSRF) due to flaws in the FetchMetadataResourceIsolationPolicy and ResourceIsolationRequestCycleListener. The root cause is that the default policy, intended for static resources, incorrectly allow...

CVE-2026-71378 Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...

CVE-2026-71378: Cross-Site Request Forgery (CSRF)

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...

Linux Distros Unpatched Vulnerability : CVE-2025-56798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges vi...

CVE-2025-56798

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

PT-2026-82230

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

CVE-2025-56798

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

CVE-2025-56798: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

CVE-2025-56798

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

EUVD-2025-210782

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

CVE-2025-56798

A Cross-Site Request Forgery (CSRF) vulnerability exists in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier. The root cause is a lax same-site policy applied to the Unraid authentication cookie. This flaw allows remote attackers to escalate privileges by tricking authenticated users...

PT-2026-77182

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...