# Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Cross-site request forgery in Oracle Corporation Oracle Enterprise Manager Base Platform](https://agentprime.io/advisories/CVE-2026-47000.md)
  `CVE-2026-47000` · CVE record: Oracle Corporation Oracle Enterprise Manager Base Platform · CVSS 3.5 Low · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views](https://agentprime.io/advisories/CVE-2026-64821.md)
  `CVE-2026-64821` · CVE record: thiagopena djangoSIGE · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Astro: composable \`astro/hono\` pipeline bypasses \`security.checkOrigin\` when \`middleware()\` is absent or misordered](https://agentprime.io/advisories/GHSA-8mv7-9c27-98vc.md)
  `GHSA-8mv7-9c27-98vc`, `CVE-2026-73423` · npm `astro`: affected `>=7.0.0, <7.0.6`, fixed in `7.0.6` · CVSS 5.1 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints](https://agentprime.io/advisories/GHSA-f5vj-f2hx-8m93.md)
  `GHSA-f5vj-f2hx-8m93`, `CVE-2026-14620` · npm `webpack-dev-server`: affected `<5.2.6`, fixed in `5.2.6` · CVSS 4.7 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Cross-site request forgery (CSRF), CWE-749
- [Cross-site request forgery in Revive Adserver](https://agentprime.io/advisories/CVE-2026-50743.md)
  `CVE-2026-50743` · CVE record: Revive Adserver · CVSS 5.4 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [dataCycle State-Changing GET Endpoints Enable CSRF](https://agentprime.io/advisories/CVE-2026-32823.md)
  `CVE-2026-32823` · CVE record: datacycle-engine dataCycle-CORE · CVSS 4.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF](https://agentprime.io/advisories/CVE-2026-13156.md)
  `CVE-2026-13156` · CVE record: Unknown MailerSend · CVSS 5.4 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [geex-arts django-jet OAuth cross-site request forgery](https://agentprime.io/advisories/CVE-2026-16216.md)
  `CVE-2026-16216` · CVE record: geex-arts django-jet · CVSS 5.3 Medium · Not analysed yet · Published 19 Jul 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Sipeed PicoClaw auth.go cross-site request forgery](https://agentprime.io/advisories/CVE-2026-16081.md)
  `CVE-2026-16081` · CVE record: Sipeed PicoClaw · CVSS 5.3 Medium · Not analysed yet · Published 18 Jul 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update](https://agentprime.io/advisories/CVE-2026-9734.md)
  `CVE-2026-9734` · CVE record: w3scloud W3SC Elementor to Zoho CRM · CVSS 4.3 Medium · Not analysed yet · Published 18 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0](https://agentprime.io/advisories/CVE-2026-60025.md)
  `CVE-2026-60025` · CVE record: joomdonation.com Events Booking extension for Joomla · CVSS 8.8 High · Not analysed yet · Published 17 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret](https://agentprime.io/advisories/CVE-2026-62236.md)
  `CVE-2026-62236` · CVE record: getgrav grav · CVSS 2.3 Low · Not analysed yet · Published 17 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter](https://agentprime.io/advisories/CVE-2026-15005.md)
  `CVE-2026-15005` · CVE record: timwhitlock Loco Translate · CVSS 8.8 High · Not analysed yet · Published 16 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF](https://agentprime.io/advisories/CVE-2026-11866.md)
  `CVE-2026-11866` · CVE record: Unknown Appointment Booking Plugin · CVSS 5.4 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action](https://agentprime.io/advisories/CVE-2026-12409.md)
  `CVE-2026-12409` · CVE record: umarbajwa Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages · CVSS 4.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-20296.md)
  `CVE-2026-20296` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 8.3 High · Not analysed yet · Published 15 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Vaultwarden: CSRF in SSO Authorization Flow](https://agentprime.io/advisories/CVE-2026-47158.md)
  `CVE-2026-47158` · CVE record: dani-garcia vaultwarden · CVSS 8.3 High · Not analysed yet · Published 15 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts.](https://agentprime.io/advisories/CVE-2026-26718.md)
  `CVE-2026-26718` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle](https://agentprime.io/advisories/CVE-2026-15747.md)
  `CVE-2026-15747` · CVE record: SRI Mojolicious · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: Cross-site request forgery (CSRF), CWE-204
- [Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests](https://agentprime.io/advisories/CVE-2026-58476.md)
  `CVE-2026-58476` · CVE record: Dan-in-CA SIP · CVSS 7.0 High · Not analysed yet · Published 14 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes](https://agentprime.io/advisories/GHSA-r8vr-m544-qh4h.md)
  `GHSA-r8vr-m544-qh4h`, `CVE-2026-52823`, `PKSA-st54-1y6x-76ks` · Packagist `kimai/kimai`: affected `<2.58.0`, fixed in `2.58.0` · CVSS 5.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function](https://agentprime.io/advisories/CVE-2026-52100.md)
  `CVE-2026-52100` · CVE record · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes](https://agentprime.io/advisories/GHSA-pgcc-vfmc-7cw5.md)
  `GHSA-pgcc-vfmc-7cw5`, `CVE-2026-49992`, `PKSA-35k6-pfzb-3chy` · Packagist `kimai/kimai`: affected `<2.58.0`, fixed in `2.58.0` · CVSS 6.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [HedgeDoc: CSRF in GitHub Gist export callback](https://agentprime.io/advisories/CVE-2026-58489.md)
  `CVE-2026-58489` · CVE record: hedgedoc hedgedoc · CVSS 6.8 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests](https://agentprime.io/advisories/CVE-2026-61502.md)
  `CVE-2026-61502` · CVE record: rejetto hfs · CVSS 5.1 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-61956.md)
  `CVE-2026-61956` · CVE record: hamsalam ووسلام \&#8211; همگام سازی ووکامرس و باسلام · CVSS 7.1 High · Not analysed yet · Published 13 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-57786.md)
  `CVE-2026-57786` · CVE record: purethemes WorkScout-Core · CVSS 8.8 High · Not analysed yet · Published 13 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071](https://agentprime.io/advisories/CVE-2026-15080.md)
  `CVE-2026-15080` · CVE record: Drupal Ray Enterprise Translation · CVSS 4.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063](https://agentprime.io/advisories/CVE-2026-13243.md)
  `CVE-2026-13243` · CVE record: Drupal Salesforce Suite · CVSS 4.8 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery](https://agentprime.io/advisories/CVE-2026-38057.md)
  `CVE-2026-38057` · CVE record: ST Engineering iDirect Evolution iQ‑Series terminals and 2 more · CVSS 7.0 High · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'](https://agentprime.io/advisories/CVE-2026-6440.md)
  `CVE-2026-6440` · CVE record: sovlix GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference · CVSS 4.3 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter](https://agentprime.io/advisories/CVE-2026-15070.md)
  `CVE-2026-15070` · CVE record: wordpresschef Salon Booking System – Free Version · CVSS 8.8 High · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint](https://agentprime.io/advisories/CVE-2026-58143.md)
  `CVE-2026-58143` · CVE record: Cotonti Cotonti · CVSS 8.7 High · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize](https://agentprime.io/advisories/GHSA-9369-69wj-7m2f.md)
  `GHSA-9369-69wj-7m2f`, `CVE-2026-52777`, `PKSA-24cb-kfcr-z2kg` · Packagist `yeswiki/yeswiki`: affected `<4.6.6`, fixed in `4.6.6` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site request forgery (CSRF), Insecure deserialization
- [Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests](https://agentprime.io/advisories/GHSA-hm42-q32m-vj4f.md)
  `GHSA-hm42-q32m-vj4f`, `CVE-2026-53760`, `PKSA-84pc-hcqd-7brb` · Packagist `admidio/admidio`: affected `<=5.0.11`, no fixed version yet · CVSS 5.2 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint](https://agentprime.io/advisories/CVE-2026-4275.md)
  `CVE-2026-4275` · CVE record: badhonrocks Divi Torque Lite – Divi Modules for the Divi Builder & Theme · CVSS 8.8 High · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack](https://agentprime.io/advisories/CVE-2026-5923.md)
  `CVE-2026-5923` · CVE record: HP Inc. Poly CCX and 2 more · CVSS 6.0 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE](https://agentprime.io/advisories/GHSA-37h2-6p4f-mp3q.md)
  `GHSA-37h2-6p4f-mp3q`, `CVE-2026-49471`, `PYSEC-2026-3061` · PyPI `serena-agent`: affected `<1.5.2`, fixed in `1.5.2` · CVSS 8.3 High · Not analysed yet · Published 8 Jul 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF)
- [Waku: Cross-Origin CSRF on RSC Server Action Dispatch](https://agentprime.io/advisories/GHSA-75w3-gmqx-993q.md)
  `GHSA-75w3-gmqx-993q`, `CVE-2026-49455` · npm `waku`: affected `<1.0.0-beta.1`, fixed in `1.0.0-beta.1` · CVSS 6.5 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE](https://agentprime.io/advisories/GHSA-xqhv-chqm-fhcc.md)
  `GHSA-xqhv-chqm-fhcc`, `CVE-2026-53649`, `GO-2026-5947` · Go `github.com/BishopFox/joro`: affected `<0.0.0-20260601151442-5c0ca35db828`, fixed in `0.0.0-20260601151442-5c0ca35db828` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), Unrestricted file upload, CWE-942
- [flask-dashboard Flask-MonitoringDashboard cross-site request forgery](https://agentprime.io/advisories/CVE-2026-15034.md)
  `CVE-2026-15034` · CVE record: flask-dashboard Flask-MonitoringDashboard · CVSS 5.3 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter](https://agentprime.io/advisories/CVE-2026-12002.md)
  `CVE-2026-12002` · CVE record: smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin · CVSS 4.7 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update](https://agentprime.io/advisories/CVE-2026-9731.md)
  `CVE-2026-9731` · CVE record: wpkuf Wp Js Detect · CVSS 4.3 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path](https://agentprime.io/advisories/GHSA-q855-8rh5-jfgq.md)
  `GHSA-q855-8rh5-jfgq` · PyPI `ha-mcp`: affected `<7.10.0`, fixed in `7.10.0` · CVSS 6.5 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF)
- [Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)](https://agentprime.io/advisories/GHSA-p5vx-9hj8-cf4h.md)
  `GHSA-p5vx-9hj8-cf4h`, `CVE-2024-7035`, `PYSEC-2026-1739` · PyPI `open-webui`: affected `<0.3.16`, fixed in `0.3.16` · CVSS 6.9 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [New API is vulnerable to CSRF through user email binding](https://agentprime.io/advisories/GHSA-26v7-h57m-gh9m.md)
  `GHSA-26v7-h57m-gh9m`, `CVE-2026-44342`, `GO-2026-5929` · Go `github.com/QuantumNous/new-api`: affected `<0.12.0-alpha.1`, fixed in `0.12.0-alpha.1` · CVSS 5.3 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in SEIKO EPSON CORPORATION Web Config](https://agentprime.io/advisories/CVE-2026-58315.md)
  `CVE-2026-58315` · CVE record: SEIKO EPSON CORPORATION Web Config · CVSS 5.1 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value](https://agentprime.io/advisories/CVE-2026-34171.md)
  `CVE-2026-34171` · CVE record: coollabsio coolify · CVSS 8.0 High · Not analysed yet · Published 7 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Leantime - OIDC Login CSRF via Unconditional State Verification Stub](https://agentprime.io/advisories/CVE-2026-59713.md)
  `CVE-2026-59713` · CVE record: Leantime Leantime · CVSS 8.6 High · Not analysed yet · Published 6 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [imhamzaazam ecommerceFlask cross-site request forgery](https://agentprime.io/advisories/CVE-2026-14800.md)
  `CVE-2026-14800` · CVE record: imhamzaazam ecommerceFlask · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-59520.md)
  `CVE-2026-59520` · CVE record: properfraction CrawlWP SEO · CVSS 4.3 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter](https://agentprime.io/advisories/CVE-2026-12740.md)
  `CVE-2026-12740` · CVE record: CORNELIUS Plack::Middleware::OAuth · CVSS 8.1 High · Not analysed yet · Published 4 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter](https://agentprime.io/advisories/CVE-2026-12746.md)
  `CVE-2026-12746` · CVE record: BIAFRA Dancer2::Plugin::Auth::OAuth::Provider · CVSS 8.1 High · Not analysed yet · Published 4 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57766.md)
  `CVE-2026-57766` · CVE record: XplodedThemes WPIDE – File Manager & Code Editor · CVSS 8.8 High · Not analysed yet · Published 2 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2026-57761.md)
  `CVE-2026-57761` · CVE record: BlueAstralThemes SEOWP · CVSS 7.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57759.md)
  `CVE-2026-57759` · CVE record: Metagauss ProfileGrid · CVSS 8.8 High · Not analysed yet · Published 2 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2026-57758.md)
  `CVE-2026-57758` · CVE record: BeRocket Permalink Manager for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57757.md)
  `CVE-2026-57757` · CVE record: ploudapp pCloud WP Backup · CVSS 7.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57751.md)
  `CVE-2026-57751` · CVE record: Heateor Support Heateor Social Login · CVSS 8.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-57747.md)
  `CVE-2026-57747` · CVE record: ThemeREX Booked · CVSS 6.5 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: Cross-site request forgery (CSRF)

Newest: <https://agentprime.io/advisories/tag/csrf.md>
Older: <https://agentprime.io/advisories/tag/csrf.md?cursor=WyIyMDI2LTA3LTAyVDExOjE1OjQ5Ljk4NjAwMFoiLCJDVkUtMjAyNi01Nzc0NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=csrf&cursor=WyIyMDI2LTA3LTIxVDIxOjM2OjE1LjQ4MzAwMFoiLCJDVkUtMjAyNi02MDYzMSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/csrf/?cursor=WyIyMDI2LTA3LTIxVDIxOjM2OjE1LjQ4MzAwMFoiLCJDVkUtMjAyNi02MDYzMSJd>. Everything for agents: <https://agentprime.io/llms.txt>.