# Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Werkstatt theme <= 4.7.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57690.md)
  `CVE-2026-57690` · CVE record: Fuelthemes Werkstatt · CVSS 4.3 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.12 - CSRF to Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-57723.md)
  `CVE-2026-57723` · CVE record: e4jvikwp VikBooking Hotel Booking Engine & PMS · CVSS 7.4 High · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter](https://agentprime.io/advisories/CVE-2026-12158.md)
  `CVE-2026-12158` · CVE record: metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login · CVSS 8.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [GiveWP <= 4.15.3 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2026-11981.md)
  `CVE-2026-11981` · CVE record: stellarwp GiveWP – Donation Plugin and Fundraising Platform · CVSS 4.3 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in The Wikimedia Foundation Mediawiki - RedirectManager Extension](https://agentprime.io/advisories/CVE-2026-58518.md)
  `CVE-2026-58518` · CVE record: The Wikimedia Foundation Mediawiki - RedirectManager Extension · CVSS 6.9 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-14016.md)
  `CVE-2026-14016` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-13963.md)
  `CVE-2026-13963` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-13952.md)
  `CVE-2026-13952` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-13946.md)
  `CVE-2026-13946` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-13944.md)
  `CVE-2026-13944` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-13887.md)
  `CVE-2026-13887` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-13826.md)
  `CVE-2026-13826` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Cross-Site Request Forgery (CSRF) in KTM System e-BOK](https://agentprime.io/advisories/CVE-2026-35096.md)
  `CVE-2026-35096` · CVE record: KTM System e-BOK · CVSS 5.1 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter](https://agentprime.io/advisories/CVE-2026-8944.md)
  `CVE-2026-8944` · CVE record: engagementanalytics Plugin for Google Analytics by IO technologies · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-43735.md)
  `CVE-2026-43735` · CVE record: Apple Safari and 4 more · CVSS 8.1 High · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [misp-modules website - Missing CSRF protection in the website home blueprint](https://agentprime.io/advisories/GHSA-j4rh-7jcr-qm69.md)
  `GHSA-j4rh-7jcr-qm69`, `CVE-2026-44364`, `PYSEC-2026-414` · PyPI `misp-modules`: affected `<=3.0.7`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [CodeAstro Human Resource Management System cross-site request forgery](https://agentprime.io/advisories/CVE-2026-13537.md)
  `CVE-2026-13537` · CVE record: CodeAstro Human Resource Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remote attacker to escalate privileges via the IdentityServer account profile endpoint](https://agentprime.io/advisories/CVE-2026-31016.md)
  `CVE-2026-31016` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers](https://agentprime.io/advisories/CVE-2026-13422.md)
  `CVE-2026-13422` · CVE record: harmonic_design HD Quiz · CVSS 4.3 Medium · Not analysed yet · Published 27 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [OpenProject: CSRF on TARGET through /users/:id via POST parameter "user\[admin\]"](https://agentprime.io/advisories/CVE-2026-52784.md)
  `CVE-2026-52784` · CVE record: opf openproject · CVSS 8.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Paid Memberships Pro - Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57659.md)
  `CVE-2026-57659` · CVE record: Stranger Studios Paid Memberships Pro - Add Member From Admin · CVSS 8.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57657.md)
  `CVE-2026-57657` · CVE record: Noor Alam Gmail SMTP · CVSS 4.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57655.md)
  `CVE-2026-57655` · CVE record: Jay Versluis Child Theme Wizard · CVSS 8.2 High · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Real Estate 7 theme <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57641.md)
  `CVE-2026-57641` · CVE record: Contempoinc Real Estate 7 · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Abandoned Cart Lite for WooCommerce plugin <= 6.8.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57637.md)
  `CVE-2026-57637` · CVE record: tychesoftwares Abandoned Cart Lite for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress FunnelKit Payment Gateway for Stripe WooCommerce plugin <= 1.14.0.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57635.md)
  `CVE-2026-57635` · CVE record: FunnelKit FunnelKit Payment Gateway for Stripe WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2025-68052.md)
  `CVE-2025-68052` · CVE record: Eagle-Themes Eagle Booking · CVSS 8.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Payara Server Full has a Cross-Site Request Forgery vulnerability](https://agentprime.io/advisories/GHSA-x939-7fq5-v9v6.md)
  `GHSA-x939-7fq5-v9v6`, `CVE-2026-12986` · Maven `fish.payara.distributions:payara`: affected `>=4.0.0, <7.2026.6`, fixed in `7.2026.6` · CVSS 7.3 High · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF), Server-side request forgery (SSRF)
- [Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability](https://agentprime.io/advisories/GHSA-6qc4-57v3-28rr.md)
  `GHSA-6qc4-57v3-28rr`, `CVE-2026-57298` · Maven `org.jenkins-ci.plugins:contrast-continuous-application-security`: affected `<3.12`, fixed in `3.12` · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Zowe zDevOps Plugin has a CSRF vulnerability](https://agentprime.io/advisories/GHSA-43m2-hcmm-qpm7.md)
  `GHSA-43m2-hcmm-qpm7`, `CVE-2026-57306` · Maven `io.jenkins.plugins:zdevops`: affected `<=1.1.3.50.ve350c9b`, no fixed version yet · CVSS 4.2 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-429r-3j78-2pxm.md)
  `GHSA-429r-3j78-2pxm`, `CVE-2026-57305` · Maven `org.jenkins-ci.plugins:assembla`: affected `<=1.4`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Gitee Plugin has a cross-site request forgery vulnerability](https://agentprime.io/advisories/GHSA-w794-rwp2-jc9m.md)
  `GHSA-w794-rwp2-jc9m`, `CVE-2026-57292` · Maven `org.jenkins-ci.plugins:gitee`: affected `<1292.v2559f2f3f2c0`, fixed in `1292.v2559f2f3f2c0` · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Priority Sorter Plugin has a CSRF vulnerability](https://agentprime.io/advisories/GHSA-fq56-wvv2-p8jf.md)
  `GHSA-fq56-wvv2-p8jf`, `CVE-2026-57290` · Maven `org.jenkins-ci.plugins:PrioritySorter`: affected `<936.937.v5581d0b`, fixed in `936.937.v5581d0b` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability](https://agentprime.io/advisories/GHSA-72c8-3wwg-r59w.md)
  `GHSA-72c8-3wwg-r59w`, `CVE-2026-57283` · Maven `io.jenkins.plugins:pipeline-groovy-lib`: affected `<4331.4333`, fixed in `4331.4333` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability](https://agentprime.io/advisories/GHSA-2x9c-vp3g-hvv2.md)
  `GHSA-2x9c-vp3g-hvv2`, `CVE-2026-57295` · Maven `com.amazon.jenkins.fleet:ec2-fleet`: affected `<4.2.3.540.va`, fixed in `4.2.3.540.va` · CVSS 5.4 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2026-11997.md)
  `CVE-2026-11997` · CVE record: seo_tools Bulk SEO Image · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [MP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2026-6292.md)
  `CVE-2026-6292` · CVE record: manuelpadillac MP Customize Login Page · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Blue Captcha <= 2.0.1 - Cross-Site Request Forgery via 'blcap_action' Parameter](https://agentprime.io/advisories/CVE-2026-10552.md)
  `CVE-2026-10552` · CVE record: jotis Blue Captcha · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [MotorDesk <= 1.1.2 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2026-9724.md)
  `CVE-2026-9724` · CVE record: motordesk MotorDesk · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Book a Room Event Calendar <= 1.9 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2026-9721.md)
  `CVE-2026-9721` · CVE record: chuhpl Book a Room Event Calendar · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Osiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter](https://agentprime.io/advisories/CVE-2026-8905.md)
  `CVE-2026-8905` · CVE record: osiris8 Osiris Signature Banner · CVSS 6.1 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Gogs Vulnerable to CSRF Leading to Organization Owner Takeover](https://agentprime.io/advisories/GHSA-pwx3-qcgw-vh7h.md)
  `GHSA-pwx3-qcgw-vh7h`, `CVE-2026-52800`, `GO-2026-5556` · Go `gogs.io/gogs`: affected `<0.14.3`, fixed in `0.14.3` · CVSS 8.8 High · Not analysed yet · Published 23 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF](https://agentprime.io/advisories/GHSA-v7j5-vc4m-723w.md)
  `GHSA-v7j5-vc4m-723w`, `CVE-2026-50132` · npm `@budibase/server`: affected `<3.39.0`, fixed in `3.39.0` · CVSS 7.3 High · Not analysed yet · Published 22 Jun 2026 · Tags: Broken access control, Cross-site request forgery (CSRF)
- [Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests](https://agentprime.io/advisories/GHSA-v3f4-w7r7-v3hm.md)
  `GHSA-v3f4-w7r7-v3hm`, `CVE-2026-58497` · npm `@zenalexa/unicli`: affected `<0.225.2`, fixed in `0.225.2` · CVSS 8.6 High · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Network-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions](https://agentprime.io/advisories/GHSA-mxjx-28vx-xjjj.md)
  `GHSA-mxjx-28vx-xjjj`, `CVE-2026-58482` · npm `network-ai`: affected `>=5.0.0, <5.12.2`, fixed in `5.12.2` · CVSS 5.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [symfony/ux-live-component: CSRF Protection Bypass — Accept Header is CORS-Safelisted](https://agentprime.io/advisories/GHSA-4m4j-hmqq-3gxm.md)
  `GHSA-4m4j-hmqq-3gxm`, `CVE-2026-49215`, `PKSA-ks3q-z9y3-61pz` · Packagist `symfony/ux-live-component`: affected `>=2.22.0, <2.36.0 || >=3.0.0, <3.1.0`, fixed in `2.36.0`, `3.1.0` · CVSS 2.1 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache APISIX: cas-auth login CSRF / session injection issue](https://agentprime.io/advisories/CVE-2026-49871.md)
  `CVE-2026-49871` · CVE record: Apache Software Foundation Apache APISIX · CVSS 2.1 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2026-11775.md)
  `CVE-2026-11775` · CVE record: adamsilverstein User Admin Simplifier · CVSS 4.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress WP EasyPay plugin <= 4.5.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-56024.md)
  `CVE-2026-56024` · CVE record: Saad Iqbal WP EasyPay · CVSS 6.5 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery in UBB.threads](https://agentprime.io/advisories/CVE-2026-54220.md)
  `CVE-2026-54220` · CVE record: UBB Systems UBB.threads · CVSS 8.6 High · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module](https://agentprime.io/advisories/GHSA-hp3v-wp32-953h.md)
  `GHSA-hp3v-wp32-953h`, `CVE-2026-55745`, `PKSA-cy3k-vcz8-1k97` · Packagist `cotonti/cotonti`: affected `<=1.0.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module](https://agentprime.io/advisories/GHSA-wx35-cv59-9gwr.md)
  `GHSA-wx35-cv59-9gwr`, `CVE-2026-55744`, `PKSA-5cx6-4jyf-9qk9` · Packagist `cotonti/cotonti`: affected `<=1.0.0`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cotonti: Cross-Site Request Forgery in the administration rights handler](https://agentprime.io/advisories/GHSA-7g3p-35vc-mgjr.md)
  `GHSA-7g3p-35vc-mgjr`, `CVE-2026-55742`, `PKSA-sv92-d57h-xntt` · Packagist `cotonti/cotonti`: affected `<=1.0.0`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cotonti CSRF in admin.config.php allows unauthorized configuration changes](https://agentprime.io/advisories/CVE-2026-55741.md)
  `CVE-2026-55741` · CVE record: Cotonti Cotonti · CVSS 8.7 High · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action](https://agentprime.io/advisories/CVE-2026-11784.md)
  `CVE-2026-11784` · CVE record: optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization · CVSS 4.3 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery (CSRF) in SimplCommerce News Module](https://agentprime.io/advisories/CVE-2026-9591.md)
  `CVE-2026-9591` · CVE record: simplcommerce SimplCommerce · CVSS 6.9 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Emergency Password Reset plugin <= 8.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2024-35648.md)
  `CVE-2024-35648` · CVE record: Andy Moyle Emergency Password Reset · CVSS 4.3 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Skyline WP theme <= 1.0.10 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2024-34810.md)
  `CVE-2024-34810` · CVE record: Extend Themes Skyline WP · CVSS 4.3 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability](https://agentprime.io/advisories/CVE-2026-22342.md)
  `CVE-2026-22342` · CVE record: PremiumPress Limited. WordPress Dating Theme · CVSS 8.8 High · Not analysed yet · Published 17 Jun 2026 · Tags: Cross-site request forgery (CSRF)
- [Open redirect in Oracle Corporation Oracle Human Resources](https://agentprime.io/advisories/CVE-2026-46955.md)
  `CVE-2026-46955` · CVE record: Oracle Corporation Oracle Human Resources · CVSS 7.5 High · Not analysed yet · Published 16 Jun 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF), Open redirect

Newest: <https://agentprime.io/advisories/tag/csrf.md>
Older: <https://agentprime.io/advisories/tag/csrf.md?cursor=WyIyMDI2LTA2LTE2VDE5OjI4OjAxLjY4MTAwMFoiLCJDVkUtMjAyNi00Njk1NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=csrf&cursor=WyIyMDI2LTA3LTAyVDExOjE1OjQ5Ljk4NjAwMFoiLCJDVkUtMjAyNi01Nzc0NyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/csrf/?cursor=WyIyMDI2LTA3LTAyVDExOjE1OjQ5Ljk4NjAwMFoiLCJDVkUtMjAyNi01Nzc0NyJd>. Everything for agents: <https://agentprime.io/llms.txt>.