# Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub](https://agentprime.io/advisories/CVE-2026-115494.md)
  `CVE-2026-115494` · CVE record: KNIME KNIME Business Hub · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-114177.md)
  `CVE-2026-114177` · CVE record: Xpro Xpro Elementor Addons · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Obot before 0.26.0 API Key Theft via CLI Login Token Request](https://agentprime.io/advisories/CVE-2026-114662.md)
  `CVE-2026-114662` · CVE record: obot-platform obot · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-114719.md)
  `CVE-2026-114719` · CVE record: Roundcube Webmail · CVSS 3.7 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Project Browser - Critical - Cross-site request forgery - SA-CONTRIB-2026-178](https://agentprime.io/advisories/CVE-2026-96374.md)
  `CVE-2026-96374` · CVE record: Drupal Project Browser · CVSS 4.2 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Tawk.to - Live chat application - Critical - Cross Site Request Forgery - SA-CONTRIB-2026-184](https://agentprime.io/advisories/CVE-2026-96388.md)
  `CVE-2026-96388` · CVE record: Drupal Tawk.to - Live chat application · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76297.md)
  `CVE-2026-76297` · CVE record: Splunk Splunk Enterprise · CVSS 4.2 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-111401.md)
  `CVE-2026-111401` · CVE record: Tailored Media Tailored Tools · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery (CSRF) in hMailServer](https://agentprime.io/advisories/CVE-2026-114470.md)
  `CVE-2026-114470` · CVE record: Progressive Robot Ltd hMailServer · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Download Manager (Free & Pro) - Privacy Settings Update via CSRF](https://agentprime.io/advisories/CVE-2026-86611.md)
  `CVE-2026-86611` · CVE record: Unknown Download Manager · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF](https://agentprime.io/advisories/CVE-2026-107127.md)
  `CVE-2026-107127` · CVE record: Unknown Uncanny Toolkit for LearnDash · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint](https://agentprime.io/advisories/CVE-2026-114093.md)
  `CVE-2026-114093` · CVE record: triggerdotdev trigger.dev · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover](https://agentprime.io/advisories/CVE-2026-114089.md)
  `CVE-2026-114089` · CVE record: triggerdotdev trigger.dev · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Trigger.dev before 4.5.12 CSRF via Slack OAuth Callback State](https://agentprime.io/advisories/CVE-2026-114072.md)
  `CVE-2026-114072` · CVE record: triggerdotdev trigger.dev · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints](https://agentprime.io/advisories/CVE-2026-114048.md)
  `CVE-2026-114048` · CVE record: WWBN AVideo · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Oracle Corporation Oracle BI Publisher](https://agentprime.io/advisories/CVE-2026-91555.md)
  `CVE-2026-91555` · CVE record: Oracle Corporation Oracle BI Publisher · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Oracle Corporation Siebel CRM End User](https://agentprime.io/advisories/CVE-2026-91393.md)
  `CVE-2026-91393` · CVE record: Oracle Corporation Siebel CRM End User · CVSS 3.1 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91300.md)
  `CVE-2026-91300` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 3.1 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-91246.md)
  `CVE-2026-91246` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Oracle Corporation Oracle Applications Framework](https://agentprime.io/advisories/CVE-2026-87408.md)
  `CVE-2026-87408` · CVE record: Oracle Corporation Oracle Applications Framework · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Oracle Corporation Siebel CRM Development](https://agentprime.io/advisories/CVE-2026-101495.md)
  `CVE-2026-101495` · CVE record: Oracle Corporation Siebel CRM Development · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Improper access control in Oracle Corporation Siebel CRM Integration](https://agentprime.io/advisories/CVE-2026-101492.md)
  `CVE-2026-101492` · CVE record: Oracle Corporation Siebel CRM Integration · CVSS 4.7 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, Cross-site request forgery (CSRF)
- [Cross-site request forgery in Oracle Corporation Siebel Life Sciences](https://agentprime.io/advisories/CVE-2026-101451.md)
  `CVE-2026-101451` · CVE record: Oracle Corporation Siebel Life Sciences · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, Cross-site request forgery (CSRF)
- [Cross-site request forgery in Oracle Corporation Siebel CRM Development](https://agentprime.io/advisories/CVE-2026-101447.md)
  `CVE-2026-101447` · CVE record: Oracle Corporation Siebel CRM Development · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-site request forgery in Oracle Corporation Siebel Apps - Marketing](https://agentprime.io/advisories/CVE-2026-101393.md)
  `CVE-2026-101393` · CVE record: Oracle Corporation Siebel Apps - Marketing · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-112836.md)
  `CVE-2026-112836` · CVE record: e4jvikwp VikRentCar · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account](https://agentprime.io/advisories/CVE-2026-86467.md)
  `CVE-2026-86467` · CVE record: Apache Software Foundation Apache Airflow Amazon provider · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Locust through 2.46.7 CSRF via Web UI /stop and /stats/reset](https://agentprime.io/advisories/CVE-2026-111883.md)
  `CVE-2026-111883` · CVE record: locustio locust · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback](https://agentprime.io/advisories/CVE-2026-110008.md)
  `CVE-2026-110008` · CVE record: @fastify/oauth2 @fastify/oauth2 · CVSS 4.2 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site request forgery (CSRF), Authentication bypass, CWE-459
- [Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow](https://agentprime.io/advisories/CVE-2026-84178.md)
  `CVE-2026-84178` · CVE record: Apache Software Foundation Apache Camel · CVSS 6.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery](https://agentprime.io/advisories/CVE-2026-112033.md)
  `CVE-2026-112033` · CVE record: aircheng-org iWebShop-5 · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter…](https://agentprime.io/advisories/CVE-2026-107084.md)
  `CVE-2026-107084` · CVE record · CVSS 8.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Gitea cross-site request forgery on repository topics](https://agentprime.io/advisories/CVE-2026-107618.md)
  `CVE-2026-107618` · CVE record: Gitea Gitea · CVSS 8.1 High · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Gitea OpenID account linking without session binding](https://agentprime.io/advisories/CVE-2026-104627.md)
  `CVE-2026-104627` · CVE record: Gitea Gitea · CVSS 5.4 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF)
- [dyad-sh dyad OAuth Callback cross-site request forgery](https://agentprime.io/advisories/CVE-2026-111988.md)
  `CVE-2026-111988` · CVE record: dyad-sh dyad · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation](https://agentprime.io/advisories/CVE-2026-112050.md)
  `CVE-2026-112050` · CVE record: gitify-app gitify · CVSS 2.3 Low · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-database](https://agentprime.io/advisories/CVE-2026-111907.md)
  `CVE-2026-111907` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF in Elasticsearch/OpenSearch Admin API Index Operations](https://agentprime.io/advisories/CVE-2026-111906.md)
  `CVE-2026-111906` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF](https://agentprime.io/advisories/CVE-2026-92433.md)
  `CVE-2026-92433` · CVE record: Unknown Patreon WordPress · CVSS 6.5 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()](https://agentprime.io/advisories/CVE-2026-92978.md)
  `CVE-2026-92978` · CVE record: wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder · CVSS 4.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation](https://agentprime.io/advisories/CVE-2026-49410.md)
  `CVE-2026-49410` · CVE record: tinyhumansai openhuman · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site request forgery (CSRF), Authentication bypass
- [WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-111413.md)
  `CVE-2026-111413` · CVE record: aThemeArt aThemeArt Theme Helper · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF](https://agentprime.io/advisories/CVE-2026-110015.md)
  `CVE-2026-110015` · CVE record: Unknown Salon Booking System · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Nginx UI: Casdoor SSO callback uses a constant \`state\` parameter (login CSRF)](https://agentprime.io/advisories/GHSA-44xr-mrhh-qm78.md)
  `GHSA-44xr-mrhh-qm78`, `CVE-2026-84312`, `GO-2026-6773` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260703131214-23d1934099b0`, fixed in `1.9.10-0.20260703131214-23d1934099b0` · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF)
- [Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)](https://agentprime.io/advisories/GHSA-526j-582w-7fm9.md)
  `GHSA-526j-582w-7fm9`, `CVE-2026-62322` · PyPI `social-auth-core`: affected `<5.0.2`, fixed in `5.0.2` · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController).](https://agentprime.io/advisories/CVE-2026-106708.md)
  `CVE-2026-106708` · CVE record · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Active Directory Password Change CSRF in AuthTake Technology's authtake](https://agentprime.io/advisories/CVE-2026-89279.md)
  `CVE-2026-89279` · CVE record: AuthTake Technology Inc. authtake · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-103076.md)
  `CVE-2026-103076` · CVE record: ThemeGrill User Registration · CVSS 5.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [FileRise: Missing CSRF enforcement for file creation and share-link creation](https://agentprime.io/advisories/CVE-2026-54459.md)
  `CVE-2026-54459` · CVE record: error311 FileRise · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints](https://agentprime.io/advisories/CVE-2022-51020.md)
  `CVE-2022-51020` · CVE record: mher flower · CVSS 6.0 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction](https://agentprime.io/advisories/CVE-2026-59977.md)
  `CVE-2026-59977` · CVE record: C4illin ConvertX · CVSS 8.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-108479.md)
  `CVE-2026-108479` · CVE record: Patreon Patreon WordPress · CVSS 8.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-108481.md)
  `CVE-2026-108481` · CVE record: Patreon Patreon WordPress · CVSS 7.4 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Netcore NR268 CGI Endpoint cross-site request forgery](https://agentprime.io/advisories/CVE-2026-108909.md)
  `CVE-2026-108909` · CVE record: Netcore NR268 · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Cross-site request forgery in Progress MarkLogic Server Query Console](https://agentprime.io/advisories/CVE-2026-85960.md)
  `CVE-2026-85960` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 7.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery in Administrative Actions](https://agentprime.io/advisories/CVE-2026-78358.md)
  `CVE-2026-78358` · CVE record: OTRS GmbH (former OTRS AG) OTRS and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Cross-Site Request Forgery in Import/Export Admin console](https://agentprime.io/advisories/CVE-2026-48211.md)
  `CVE-2026-48211` · CVE record: OTRS GmbH (former OTRS AG) OTRS and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Hotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRF](https://agentprime.io/advisories/CVE-2026-84166.md)
  `CVE-2026-84166` · CVE record: Unknown Hotel Booking · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [yangzongzhuan RuoYi cross-site request forgery](https://agentprime.io/advisories/CVE-2026-108800.md)
  `CVE-2026-108800` · CVE record: yangzongzhuan RuoYi · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Traccar 5.7 through 6.16.0 Login CSRF via OpenID Connect Callback](https://agentprime.io/advisories/CVE-2026-108738.md)
  `CVE-2026-108738` · CVE record: Traccar Traccar · CVSS 2.3 Low · Not analysed yet · Published 11 Oct 2026 · Tags: Cross-site request forgery (CSRF)

Newest: <https://agentprime.io/advisories/tag/csrf.md>
Older: <https://agentprime.io/advisories/tag/csrf.md?cursor=WyIyMDI2LTEwLTExVDEyOjE5OjQzLjYwMjAwMFoiLCJDVkUtMjAyNi0xMDg3MzgiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=csrf&cursor=WyIyMDI2LTEwLTIyVDE2OjQ3OjU0LjAwMDAwMFoiLCJHSFNBLTJwOGMtZ3I4Ny0yNjc2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/csrf/?cursor=WyIyMDI2LTEwLTIyVDE2OjQ3OjU0LjAwMDAwMFoiLCJHSFNBLTJwOGMtZ3I4Ny0yNjc2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.