# Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [OpenRefine through 3.10.1 CSRF to RCE via get-rows Command](https://agentprime.io/advisories/CVE-2026-108553.md)
  `CVE-2026-108553` · CVE record: OpenRefine OpenRefine · CVSS 7.7 High · Not analysed yet · Published 10 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Contao: Cross-site request forgery in custom backend actions](https://agentprime.io/advisories/GHSA-9ff2-p842-45wq.md)
  `GHSA-9ff2-p842-45wq`, `CVE-2026-107848`, `PKSA-6ymc-kdpm-qx87` · Packagist `contao/core-bundle`: affected `>=4.0.0, <5.3.50 || >=5.4.0-RC1, <5.7.12`, fixed in `5.3.50`, `5.7.12` · CVSS 3.5 Low · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs](https://agentprime.io/advisories/GHSA-33rr-wq23-g6gg.md)
  `GHSA-33rr-wq23-g6gg`, `CVE-2026-107809`, `GO-2026-6703` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b`, fixed in `1.9.10-0.20260728074433-a3999bd78a3b` · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-62026.md)
  `CVE-2026-62026` · CVE record: MIGHTYminnow Dashboard Notes · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF](https://agentprime.io/advisories/CVE-2026-85348.md)
  `CVE-2026-85348` · CVE record: Unknown GDPR Data Request Form · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-96671.md)
  `CVE-2026-96671` · CVE record: fifu.app Featured Image from URL · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions](https://agentprime.io/advisories/CVE-2026-107831.md)
  `CVE-2026-107831` · CVE record: banq jivejdon · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-78388.md)
  `CVE-2026-78388` · CVE record: IBM Security Verify Access and 3 more · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery in Malcolm](https://agentprime.io/advisories/CVE-2026-107337.md)
  `CVE-2026-107337` · CVE record: CISA Malcolm · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Pydantic AI Web chat UI (\`Agent.to_web()\`, \`clai web\`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint](https://agentprime.io/advisories/GHSA-h4xc-3qfq-jf93.md)
  `GHSA-h4xc-3qfq-jf93`, `CVE-2026-107295`, `PYSEC-2026-4278`, `PYSEC-2026-4287` · PyPI `pydantic-ai` and 1 more: affected `>=1.34.0, <1.107.4 || >=2.0.0b1, <2.28.0`, fixed in `1.107.4`, `2.28.0` · CVSS 7.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-106611.md)
  `CVE-2026-106611` · CVE record: WPMU DEV Forminator · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0](https://agentprime.io/advisories/CVE-2026-102784.md)
  `CVE-2026-102784` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-62142.md)
  `CVE-2026-62142` · CVE record: Melapress WP 2FA · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability](https://agentprime.io/advisories/CVE-2026-66479.md)
  `CVE-2026-66479` · CVE record: Liquid Web / StellarWP WPComplete · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF](https://agentprime.io/advisories/CVE-2026-105260.md)
  `CVE-2026-105260` · CVE record: Unknown Database Addon For WPForms ( wpforms entries ) · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding](https://agentprime.io/advisories/GHSA-xf64-4pmc-h8qf.md)
  `GHSA-xf64-4pmc-h8qf`, `CVE-2026-45161`, `PYSEC-2026-4317` · PyPI `wger`: affected `<=2.1`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications.](https://agentprime.io/advisories/CVE-2025-70522.md)
  `CVE-2025-70522` · CVE record · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications.](https://agentprime.io/advisories/CVE-2025-70517.md)
  `CVE-2025-70517` · CVE record · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-106216.md)
  `CVE-2026-106216` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [SourceCodester Drug Recommendation System cross-site request forgery](https://agentprime.io/advisories/CVE-2026-105706.md)
  `CVE-2026-105706` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Joplin Web Clipper pairing allows cross-origin theft of a permanent API token](https://agentprime.io/advisories/CVE-2026-105783.md)
  `CVE-2026-105783` · CVE record: laurent22 joplin · CVSS 8.0 High · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0](https://agentprime.io/advisories/CVE-2026-102778.md)
  `CVE-2026-102778` · CVE record: svenbluege.de Event Gallery for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site request forgery (CSRF), Open redirect
- [Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0](https://agentprime.io/advisories/CVE-2026-102776.md)
  `CVE-2026-102776` · CVE record: svenbluege.de Event Gallery for Joomla · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-104407.md)
  `CVE-2026-104407` · CVE record: Blubrry Podcasting PowerPress Podcasting · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback](https://agentprime.io/advisories/CVE-2026-105292.md)
  `CVE-2026-105292` · CVE record: chaterm Chaterm · CVSS 6.0 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass](https://agentprime.io/advisories/CVE-2026-93549.md)
  `CVE-2026-93549` · CVE record: Unknown CoCart · CVSS 8.8 High · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (\`/ws/network/proxy\`) via explicit \`CheckOrigin: true\` bypass](https://agentprime.io/advisories/GHSA-3cc2-h3v6-rqpq.md)
  `GHSA-3cc2-h3v6-rqpq`, `CVE-2026-74802`, `GO-2026-6650` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260803045322-cb67e0b4fab5`, fixed in `0.0.0-20260803045322-cb67e0b4fab5` · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF), Server-side request forgery (SSRF), CWE-346
- [WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-39718.md)
  `CVE-2026-39718` · CVE record: Webriti Wallstreet · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action](https://agentprime.io/advisories/CVE-2026-104453.md)
  `CVE-2026-104453` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler](https://agentprime.io/advisories/CVE-2026-104452.md)
  `CVE-2026-104452` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler](https://agentprime.io/advisories/CVE-2026-104451.md)
  `CVE-2026-104451` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler](https://agentprime.io/advisories/CVE-2026-104448.md)
  `CVE-2026-104448` · CVE record: YesWiki yeswiki · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction](https://agentprime.io/advisories/CVE-2026-104447.md)
  `CVE-2026-104447` · CVE record: YesWiki yeswiki · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request](https://agentprime.io/advisories/CVE-2026-56662.md)
  `CVE-2026-56662` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction](https://agentprime.io/advisories/CVE-2026-56660.md)
  `CVE-2026-56660` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF), Unrestricted file upload, Server-side request forgery (SSRF)
- [Lektor 3.3.14 CSRF via Admin API Endpoints](https://agentprime.io/advisories/CVE-2026-104059.md)
  `CVE-2026-104059` · CVE record: lektor lektor · CVSS 7.0 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-103067.md)
  `CVE-2026-103067` · CVE record: Memberful Memberful - Membership Plugin · CVSS 8.0 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin](https://agentprime.io/advisories/CVE-2026-94220.md)
  `CVE-2026-94220` · CVE record: Apache Software Foundation Apache APISIX · CVSS 2.1 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery](https://agentprime.io/advisories/CVE-2026-103285.md)
  `CVE-2026-103285` · CVE record: TryGhost Ghost · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager](https://agentprime.io/advisories/CVE-2026-64947.md)
  `CVE-2026-64947` · CVE record: Pandora FMS Pandora FMS · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF), Unrestricted file upload
- [CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager](https://agentprime.io/advisories/CVE-2026-64946.md)
  `CVE-2026-64946` · CVE record: Pandora FMS Pandora FMS · CVSS 7.4 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF)
- [CSRF in Alert Command Deletion](https://agentprime.io/advisories/CVE-2026-34190.md)
  `CVE-2026-34190` · CVE record: Pandora FMS Pandora FMS · CVSS 5.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [CSRF in Event Response Deletion](https://agentprime.io/advisories/CVE-2026-34189.md)
  `CVE-2026-34189` · CVE record: Pandora FMS Pandora FMS · CVSS 5.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF](https://agentprime.io/advisories/CVE-2026-101147.md)
  `CVE-2026-101147` · CVE record: Unknown Featured Image from URL (FIFU) and 1 more · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-102399.md)
  `CVE-2026-102399` · CVE record: supsystic Photo Gallery by Supsystic · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-97299.md)
  `CVE-2026-97299` · CVE record: KnitPay Razorpay Payment Links for WooCommerce · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Blacklist Manager \&#8211; WooCommerce Anti-Fraud, Blacklist \&amp; Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-96838.md)
  `CVE-2026-96838` · CVE record: YoOhw Studio Blacklist Manager \&#8211; WooCommerce Anti-Fraud, Blacklist \&amp; Checkout Verification · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-95362.md)
  `CVE-2026-95362` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-73597.md)
  `CVE-2026-73597` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery in admin panel of Quick.Cart](https://agentprime.io/advisories/CVE-2026-41875.md)
  `CVE-2026-41875` · CVE record: OpenSolution Quick.Cart · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback.](https://agentprime.io/advisories/CVE-2026-67993.md)
  `CVE-2026-67993` · CVE record · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion](https://agentprime.io/advisories/CVE-2026-101093.md)
  `CVE-2026-101093` · CVE record: Cotonti Cotonti · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache Roller: CSRF protection bypass via self-generated salt validation](https://agentprime.io/advisories/CVE-2026-82380.md)
  `CVE-2026-82380` · CVE record: Apache Software Foundation Apache Roller · CVSS 8.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [mathurvishal CloudClassroom-PHP-Project cross-site request forgery](https://agentprime.io/advisories/CVE-2026-100873.md)
  `CVE-2026-100873` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0](https://agentprime.io/advisories/CVE-2026-100748.md)
  `CVE-2026-100748` · CVE record: svenbluege.de Event Gallery for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0](https://agentprime.io/advisories/CVE-2026-100747.md)
  `CVE-2026-100747` · CVE record: svenbluege.de Event Gallery for Joomla · CVSS 5.1 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0](https://agentprime.io/advisories/CVE-2026-100749.md)
  `CVE-2026-100749` · CVE record: svenbluege.de Event Gallery for Joomla · CVSS 5.1 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF](https://agentprime.io/advisories/CVE-2026-100712.md)
  `CVE-2026-100712` · CVE record: froxlor froxlor · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF](https://agentprime.io/advisories/CVE-2026-96524.md)
  `CVE-2026-96524` · CVE record: Unknown MCP Server for WordPress · CVSS 8.8 High · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager](https://agentprime.io/advisories/CVE-2026-100524.md)
  `CVE-2026-100524` · CVE record: Cotonti Cotonti · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site request forgery (CSRF)

Newest: <https://agentprime.io/advisories/tag/csrf.md>
Older: <https://agentprime.io/advisories/tag/csrf.md?cursor=WyIyMDI2LTA5LTI2VDAwOjU5OjI0Ljk4NjAwMFoiLCJDVkUtMjAyNi0xMDA1MjQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=csrf&cursor=WyIyMDI2LTEwLTExVDEyOjE5OjQzLjYwMjAwMFoiLCJDVkUtMjAyNi0xMDg3MzgiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/csrf/?cursor=WyIyMDI2LTEwLTExVDEyOjE5OjQzLjYwMjAwMFoiLCJDVkUtMjAyNi0xMDg3MzgiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.