CVE-2026-90893: Cross-Site Request Forgery (CSRF)

MISP contains a Cross-Site Request Forgery CSRF vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation both token and field-hash checks fo...

Mail.ru: [xss] setTheme в ajax_attach_action

Reflected XSS in e.mail.ru via GET parameter setTheme...