Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

concrete5/concrete5 Packagist

CVSS 7.5 High

Concrete does not validate a CSRF token before processing requests to `/dashboard/extend/update/do_update/<pkgHandle>`
- Cross-site request forgery (CSRF)
<9.5.1 · fixed in 9.5.1

GHSA-jr5g-qv3g-rxxx · CVE-2026-8417 Not analysed yet 21 May 2026
concrete5/concrete5 Packagist

CVSS 7.5 High

Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`
- Cross-site request forgery (CSRF)
- CWE-829
<9.5.1 · fixed in 9.5.1

GHSA-5rj5-gfmr-hrc3 · CVE-2026-8426 Not analysed yet 21 May 2026
concrete5/concrete5 Packagist

CVSS 7.5 High

Concrete CMS contains a CSRF vulnerability
- Cross-site request forgery (CSRF)
<9.5.1 · fixed in 9.5.1

GHSA-4c8m-6fwx-m7xq · CVE-2026-8421 Not analysed yet 21 May 2026
concrete5/concrete5 Packagist

CVSS 7.5 High

Concrete CMS is Vulnerable to Cross-Site Request Forgery
- Cross-site request forgery (CSRF)
<9.5.1 · fixed in 9.5.1

GHSA-r42c-3rr2-jrfp · CVE-2026-8140 Not analysed yet 21 May 2026
CVE-2026-22880 CVE record

CVSS 6.1 Medium

Mobile SSO authentication flow allows credential theft via malicious server
- Mattermost
- Cross-site request forgery (CSRF)
Not analysed yet 21 May 2026
CVE-2025-11954 CVE record

CVSS 8.0 High

CSRF in Sitemio's WISECP
- Sitemio Information Technologies Trade Ltd. Co. WISECP
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-6405 CVE record

CVSS 4.3 Medium

Anomify AI <= 0.3.6 - Cross-Site Request Forgery
- simonholliday Anomify AI – Anomaly Detection and Alerting
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-6395 CVE record

CVSS 6.1 Medium

Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page
- winking Word 2 Cash
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-6400 CVE record

CVSS 4.3 Medium

Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form
- helpstring Child Height Predictor by Ostheimer
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-6401 CVE record

CVSS 4.3 Medium

Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update
- svil4ok Bottom Bar
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-8419 CVE record

CVSS 4.3 Medium

Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
- submone Amazon Scraper
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-8424 CVE record

CVSS 4.3 Medium

Remove Yellow BGBOX <= 1.0 - Cross-Site Request Forgery
- jay_patel Remove Yellow BGBOX
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-6391 CVE record

CVSS 6.1 Medium

Sentence To SEO (keywords, description and tags) <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters
- eazyserver Sentence To SEO (keywords, description and tags)
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-8420 CVE record

CVSS 6.1 Medium

BLOGCHAT Chat System <= 1.3.6.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
- rdbeach BLOGCHAT Chat System
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-8423 CVE record

CVSS 4.3 Medium

JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery
- JaviBola Custom Theme Test
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-6452 CVE record

CVSS 4.3 Medium

Bigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset and Update
- ktulhu Bigfishgames Syndicate
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-8418 CVE record

CVSS 4.3 Medium

Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion
- askywhale Games Catalog
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
CVE-2026-44925 CVE record

CVSS 8.8 High

Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to force the user with an active session into clicking a malicious HTML link, which t…
- Cross-site request forgery (CSRF)
Not analysed yet 20 May 2026
turbo npm

CVSS 5.1 Medium

Turbo: Login callback CSRF/session fixation
- Cross-site request forgery (CSRF)
- Authentication bypass
<2.9.14 · fixed in 2.9.14

GHSA-hcf7-66rw-9f5r · CVE-2026-45773 Not analysed yet 19 May 2026
CVE-2026-8604 CVE record

CVSS 8.6 High

Cross-Site request forgery (CSRF) in ScadaBR
- ScadaBR
- Cross-site request forgery (CSRF)
Not analysed yet 19 May 2026
CVE-2018-25334 CVE record

CVSS 5.3 Medium

Zechat 1.5 Cross-Site Request Forgery (CSRF) via hashtag parameter
- Bylancer Zechat
- Cross-site request forgery (CSRF)
Not analysed yet 17 May 2026
CVE-2018-25337 CVE record

CVSS 5.3 Medium

Joomla JoomOCShop 1.0 Cross-Site Request Forgery
- Joomlaextensions Joomla! extension JoomOCShop
- Cross-site request forgery (CSRF)
Not analysed yet 17 May 2026
CVE-2018-25336 CVE record

CVSS 6.9 Medium

jCart for OpenCart 2.3.0.2 Cross-Site Request Forgery
- jCart for OpenCart
- Cross-site request forgery (CSRF)
Not analysed yet 17 May 2026
CVE-2018-25327 CVE record

CVSS 6.9 Medium

Joomla! Component Js Jobs 1.2.0 Cross-Site Request Forgery
- Joomsky JS Jobs
- Cross-site request forgery (CSRF)
Not analysed yet 17 May 2026
CVE-2018-25321 CVE record

CVSS 5.3 Medium

TP-Link TL-WR720N CSRF via Administrative Interfaces (firmware V1_130719)
- Tp-link TL-WR720NMbps Wireless N Router
- Cross-site request forgery (CSRF)
Not analysed yet 17 May 2026
CVE-2020-37241 CVE record

CVSS 6.9 Medium

bloofoxCMS 0.5.2.1 Cross-Site Request Forgery via user add
- bloofoxCMS
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2026
CVE-2021-47976 CVE record

CVSS 8.7 High

TextPattern CMS 4.9.0-dev Authenticated Remote Code Execution via Plugin Upload
- TextPattern CMS
- Cross-site request forgery (CSRF)
Not analysed yet 16 May 2026
WWBN/AVideo Packagist

CVSS 5.7 Medium

AVideo: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA
- Authentication bypass
- Cross-site request forgery (CSRF)
<=29.0 · no fixed version yet

GHSA-3mv2-vmwh-rwfx · CVE-2026-45610 Not analysed yet 15 May 2026
better-auth npm

CVSS 6.0 Medium

Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE
- Authentication bypass
- Cross-site request forgery (CSRF)
<1.6.2 · fixed in 1.6.2

GHSA-wxw3-q3m9-c3jr · CVE-2026-67335 Not analysed yet 15 May 2026
CVE-2026-8425 CVE record

CVSS 4.3 Medium

Notify Odoo <= 1.0.1 - Cross-Site Request Forgery to Settings Update
- pektsekye Notify Odoo
- Cross-site request forgery (CSRF)
Not analysed yet 15 May 2026
CVE-2026-28761 CVE record

CVSS 8.5 High

Cross-site request forgery in Fujitsu Japan Limited Musetheque V4 Information Disclosure for IPKNOWLEDGE
- Fujitsu Japan Limited Musetheque V4 Information Disclosure for IPKNOWLEDGE
- Cross-site request forgery (CSRF)
Not analysed yet 15 May 2026
open-webui PyPI

CVSS 4.6 Medium

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation
- Cross-site request forgery (CSRF)
- CWE-20
<0.9.3 · fixed in 0.9.3

GHSA-j6w6-986j-2m2m · CVE-2026-45317 Not analysed yet 14 May 2026
CVE-2026-5365 CVE record

CVSS 4.3 Medium

LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site request forgery (CSRF)
Not analysed yet 14 May 2026
CVE-2026-4527 CVE record

CVSS 6.5 Medium

Cross-Site Request Forgery (CSRF) in GitLab
- GitLab
- Cross-site request forgery (CSRF)
Not analysed yet 14 May 2026
CVE-2020-37217 CVE record

CVSS 5.1 Medium

Easy2Pilot 7 Cross-Site Request Forgery via admin.php
- Easy2Pilot
- Cross-site request forgery (CSRF)
Not analysed yet 13 May 2026
CVE-2026-40703 CVE record

CVSS 5.3 Medium

BIG-IP Configuration utility CSRF vulnerability
- F5 BIG-IP
- Cross-site request forgery (CSRF)
Not analysed yet 13 May 2026
CVE-2025-27851 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack.
- Cross-site request forgery (CSRF)
Not analysed yet 13 May 2026
CVE-2026-44347 CVE record

CVSS 5.8 Medium

Warpgate: SSO CSRF -- State Token Not Validated on Return
- warp-tech warpgate
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2026
CVE-2026-44548 CVE record

CVSS 8.1 High

ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)
- CRM
- Cross-site request forgery (CSRF)
- CWE-650
Not analysed yet 12 May 2026
CVE-2026-42289 CVE record

CVSS 8.8 High

ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation
- CRM
- Privilege escalation
- Authentication bypass
Not analysed yet 12 May 2026
@gitlawb/openclaude npm

CVSS 6.5 Medium

OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
- Cross-site request forgery (CSRF)
- Denial of service
<0.5.1 · fixed in 0.5.1

GHSA-c73c-x77g-854r · CVE-2026-42073 Not analysed yet 12 May 2026
CVE-2026-30807 CVE record

CVSS 7.1 High

Cross-Site Request Forgery on Extension Pages
- Pandora FMS
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2026
CVE-2026-6710 CVE record

CVSS 4.3 Medium

Skysa Text Ticker App <= 1.4 - Cross-Site Request Forgery to Settings Modification via 'Save Settings' Form
- davidskysa Skysa Text Ticker App
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2026
CVE-2026-6932 CVE record

CVSS 4.3 Medium

Woo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Form
- hemant29 Woo Commerce Minimum Weight
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2026
CVE-2026-7616 CVE record

CVSS 4.3 Medium

Zawgyi Embed <= 2.1.1 - Cross-Site Request Forgery via 'zawgyi_forceCSS' Parameter
- saturngod Zawgyi Embed
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2026
CVE-2026-7561 CVE record

CVSS 6.1 Medium

Tm – WordPress Redirection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- tienrocker Tm – WordPress Redirection
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2026
CVE-2026-7562 CVE record

CVSS 4.3 Medium

WP-Redirection <= 1.0.3 - Cross-Site Request Forgery to Settings Update
- phkcorp2005 WP-Redirection
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2026
CVE-2026-45430 CVE record

CVSS 7.1 High

Cross-site request forgery in Backdrop CMS contributed projects backdrop-contrib/salesforce
- Backdrop CMS contributed projects backdrop-contrib/salesforce
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2026
CVE-2026-0502 CVE record

CVSS 5.4 Medium

Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform
- SAP_SE SAP BusinessObjects Business Intelligence Platform
- Cross-site request forgery (CSRF)
Not analysed yet 12 May 2026
CVE-2026-44695 CVE record

CVSS 5.8 Medium

Outline: Slack OAuth state can link a victim Outline account to an attacker Slack identity
- outline
- Cross-site request forgery (CSRF)
Not analysed yet 11 May 2026
CVE-2026-38566 CVE record

CVSS 8.1 High

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint.
- Cross-site request forgery (CSRF)
Not analysed yet 11 May 2026
CVE-2021-47953 CVE record

CVSS 5.3 Medium

OpenCart 3.0.3.7 Cross-Site Request Forgery via account/password
- OpenCart
- Cross-site request forgery (CSRF)
Not analysed yet 10 May 2026
CVE-2021-47946 CVE record

CVSS 6.9 Medium

OpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery
- OpenCart
- Cross-site request forgery (CSRF)
Not analysed yet 10 May 2026
CVE-2022-50955 CVE record

CVSS 5.3 Medium

WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery
- Curtain
- Cross-site request forgery (CSRF)
Not analysed yet 10 May 2026
CVE-2026-8194 CVE record

CVSS 5.3 Medium

osTicket Dispatcher class.dispatcher.php cross-site request forgery
- osTicket
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 9 May 2026
CVE-2026-42286 CVE record

CVSS 8.4 High

Emlog: Cross-Site Request Forgery in Admin Functions
- emlog
- Cross-site request forgery (CSRF)
Not analysed yet 8 May 2026
CVE-2026-5791 CVE record

CVSS 6.5 Medium

CSRF in DivvyDrive Information Technologies' DivvyDrive
- DivvyDrive
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2026
CVE-2026-27415 CVE record

CVSS 4.3 Medium

WordPress BEAR plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- PluginUs.Net BEAR
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2026
CVE-2026-28201 CVE record

CVSS 8.7 High

SurrealDB Injection on Open Notebook
- Open Notebook
- Cross-site request forgery (CSRF)
- Code injection
Not analysed yet 7 May 2026
CVE-2025-68604 CVE record

CVSS 5.4 Medium

WordPress WPGraphQL plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability
- WPGraphQL
- Cross-site request forgery (CSRF)
Not analysed yet 7 May 2026