EUVD-2026-97270

User-controlled values are not sufficiently neutralized when included in CSV exports. Values originating from user input, including data submitted by authenticated users or received through external communication channels such as email, may be stored in fields that are later included in CSV...

CVE-2026-21012-Rust-serde-Deserialization-of-Untrusted-Enum-Variant-Injection-

CVE-2026-21012 – Rust serde Deserialization of Untrusted Enum Variant Injection Program Code Rust // serdevuln.rs - Deserializes an enum from user JSON without validation use serde::Deserialize, Serialize; use serdejson; deriveDeserialize, Debug enum AdminAction ReadLogs, DeleteUserString,...

Advanced Filesystem - Moderately critical - Cross-Site Request Forgery - SA-CONTRIB-2026-217

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...

DRUPAL-CONTRIB-2026-184

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

PT-2026-97678

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

CVE-2026-55061

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

CVE-2026-55061

uniget CLI (a universal installer and updater for container tools) contains an argument injection vulnerability in cmd/uniget/hooks.go (line 199). The hooks edit command parses the UNIGET_EDITOR or EDITOR environment variable using strings.Split(editor, " "), passing every space-delimited suffix ...

EUVD-2026-82371

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

CVE-2026-55061: Improper Neutralization of Argument Delimiters in a Command

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGETEDITOR or EDITOR with strings.Spliteditor, " " and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can...

CVE-2026-76959

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2026-76961 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

CVE-2026-76960 Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

EUVD-2026-72579

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2026-76960: Cross-Site Request Forgery (CSRF)

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

PT-2026-86954

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

CVE-2026-14951

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14951 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

PT-2026-78909

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

PT-2026-69443

Name of the Vulnerable Software and Affected Versions WP Umbrella versions 2.24.2 through 2.26.2 Description A Cross-Site Request Forgery CSRF flaw exists in WP Umbrella. This issue allows an attacker to induce a user to perform actions they did not intend to do by tricking them into clicking a...