Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-47000 CVE record

CVSS 3.5 Low

Cross-site request forgery in Oracle Corporation Oracle Enterprise Manager Base Platform
- Oracle Corporation Oracle Enterprise Manager Base Platform
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
CVE-2026-64821 CVE record

CVSS 5.3 Medium

djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views
- thiagopena djangoSIGE
- Cross-site request forgery (CSRF)
Not analysed yet 21 Jul 2026
astro npm

CVSS 5.1 Medium

Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
- Cross-site request forgery (CSRF)
>=7.0.0, <7.0.6 · fixed in 7.0.6

GHSA-8mv7-9c27-98vc · CVE-2026-73423 Not analysed yet 20 Jul 2026
webpack-dev-server npm

CVSS 4.7 Medium

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
- Cross-site request forgery (CSRF)
- CWE-749
<5.2.6 · fixed in 5.2.6

GHSA-f5vj-f2hx-8m93 · CVE-2026-14620 Not analysed yet 20 Jul 2026
CVE-2026-50743 CVE record

CVSS 5.4 Medium

Cross-site request forgery in Revive Adserver
- Revive Adserver
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jul 2026
CVE-2026-32823 CVE record

CVSS 4.3 Medium

dataCycle State-Changing GET Endpoints Enable CSRF
- datacycle-engine dataCycle-CORE
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jul 2026
CVE-2026-13156 CVE record

CVSS 5.4 Medium

MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF
- MailerSend
- Cross-site request forgery (CSRF)
Not analysed yet 20 Jul 2026
CVE-2026-16216 CVE record

CVSS 5.3 Medium

geex-arts django-jet OAuth cross-site request forgery
- geex-arts django-jet
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 19 Jul 2026
CVE-2026-16081 CVE record

CVSS 5.3 Medium

Sipeed PicoClaw auth.go cross-site request forgery
- Sipeed PicoClaw
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 18 Jul 2026
CVE-2026-9734 CVE record

CVSS 4.3 Medium

W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update
- w3scloud W3SC Elementor to Zoho CRM
- Cross-site request forgery (CSRF)
Not analysed yet 18 Jul 2026
CVE-2026-60025 CVE record

CVSS 8.8 High

Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0
- joomdonation.com Events Booking extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 17 Jul 2026
CVE-2026-62236 CVE record

CVSS 2.3 Low

grav-plugin-login < 3.8.11 CSRF via regenerate2FASecret
- grav
- Cross-site request forgery (CSRF)
Not analysed yet 17 Jul 2026
CVE-2026-15005 CVE record

CVSS 8.8 High

Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter
- timwhitlock Loco Translate
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2026
CVE-2026-11866 CVE record

CVSS 5.4 Medium

LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF
- Appointment Booking Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2026
CVE-2026-12409 CVE record

CVSS 4.3 Medium

Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to ulpb_admin_data AJAX Action
- umarbajwa Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages
- Cross-site request forgery (CSRF)
Not analysed yet 16 Jul 2026
CVE-2026-20296 CVE record

CVSS 8.3 High

SPL Command Safeguards Bypass through Cross-Site Request Forgery (CSRF) in Deployment Server in Splunk Enterprise
- Splunk Enterprise
- Splunk Cloud Platform
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jul 2026
CVE-2026-47158 CVE record

CVSS 8.3 High

Vaultwarden: CSRF in SSO Authorization Flow
- dani-garcia vaultwarden
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jul 2026
CVE-2026-26718 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts.
- Cross-site request forgery (CSRF)
Not analysed yet 15 Jul 2026
CVE-2026-15747 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle
- SRI Mojolicious
- Cross-site request forgery (CSRF)
- CWE-204
Not analysed yet 14 Jul 2026
CVE-2026-58476 CVE record

CVSS 7.0 High

Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests
- Dan-in-CA SIP
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jul 2026
kimai/kimai Packagist

CVSS 5.3 Medium

Kimai: Login CSRF in the Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes
- Cross-site request forgery (CSRF)
<2.58.0 · fixed in 2.58.0

GHSA-r8vr-m544-qh4h · CVE-2026-52823 Not analysed yet 14 Jul 2026
CVE-2026-52100 CVE record

CVSS 7.5 High

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function
- Cross-site request forgery (CSRF)
Not analysed yet 14 Jul 2026
kimai/kimai Packagist

CVSS 6.3 Medium

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes
- Cross-site request forgery (CSRF)
<2.58.0 · fixed in 2.58.0

GHSA-pgcc-vfmc-7cw5 · CVE-2026-49992 Not analysed yet 13 Jul 2026
CVE-2026-58489 CVE record

CVSS 6.8 Medium

HedgeDoc: CSRF in GitHub Gist export callback
- hedgedoc
- Cross-site request forgery (CSRF)
Not analysed yet 13 Jul 2026
CVE-2026-61502 CVE record

CVSS 5.1 Medium

Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests
- rejetto hfs
- Cross-site request forgery (CSRF)
Not analysed yet 13 Jul 2026
CVE-2026-61956 CVE record

CVSS 7.1 High

WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability
- hamsalam ووسلام – همگام سازی ووکامرس و باسلام
- Cross-site request forgery (CSRF)
Not analysed yet 13 Jul 2026
CVE-2026-57786 CVE record

CVSS 8.8 High

WordPress WorkScout-Core plugin <= 1.7.08 - Cross Site Request Forgery (CSRF) to Broken Authentication vulnerability
- purethemes WorkScout-Core
- Cross-site request forgery (CSRF)
Not analysed yet 13 Jul 2026
CVE-2026-15080 CVE record

CVSS 4.3 Medium

Ray Enterprise Translation - Moderately critical - Cross site request forgery - SA-CONTRIB-2026-071
- Drupal Ray Enterprise Translation
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jul 2026
CVE-2026-13243 CVE record

CVSS 4.8 Medium

Salesforce Suite - Moderately critical - Cross-site request forgery - SA-CONTRIB-2026-063
- Drupal Salesforce Suite
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jul 2026
CVE-2026-38057 CVE record

CVSS 7.0 High

ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery
- ST Engineering iDirect Evolution iQ‑Series terminals
- ST Engineering iDirect 3315-Series terminals
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jul 2026
CVE-2026-6440 CVE record

CVSS 4.3 Medium

GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'
- sovlix GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jul 2026
CVE-2026-15070 CVE record

CVSS 8.8 High

Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter
- wordpresschef Salon Booking System – Free Version
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jul 2026
CVE-2026-58143 CVE record

CVSS 8.7 High

Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint
- Cotonti
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jul 2026
yeswiki/yeswiki Packagist

CVSS 9.4 CriticalCritical · CVSS 9+

YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
- Cross-site request forgery (CSRF)
- Insecure deserialization
<4.6.6 · fixed in 4.6.6

GHSA-9369-69wj-7m2f · CVE-2026-52777 Not analysed yet 9 Jul 2026
admidio/admidio Packagist

CVSS 5.2 Medium

Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
- Cross-site request forgery (CSRF)
<=5.0.11 · no fixed version yet

GHSA-hm42-q32m-vj4f · CVE-2026-53760 Not analysed yet 9 Jul 2026
CVE-2026-4275 CVE record

CVSS 8.8 High

Divi Torque Lite <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint
- badhonrocks Divi Torque Lite – Divi Modules for the Divi Builder & Theme
- Cross-site request forgery (CSRF)
Not analysed yet 9 Jul 2026
CVE-2026-5923 CVE record

CVSS 6.0 Medium

Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack
- HP Inc. Poly CCX
- HP Inc. Poly Edge E
- Cross-site request forgery (CSRF)
Not analysed yet 8 Jul 2026
serena-agent PyPI

CVSS 8.3 High

Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
- Authentication bypass
- Cross-site request forgery (CSRF)
<1.5.2 · fixed in 1.5.2

GHSA-37h2-6p4f-mp3q · CVE-2026-49471 Not analysed yet 8 Jul 2026
waku npm

CVSS 6.5 Medium

Waku: Cross-Origin CSRF on RSC Server Action Dispatch
- Cross-site request forgery (CSRF)
<1.0.0-beta.1 · fixed in 1.0.0-beta.1

GHSA-75w3-gmqx-993q · CVE-2026-49455 Not analysed yet 8 Jul 2026
github.com/BishopFox/joro Go

CVSS 9.6 CriticalCritical · CVSS 9+

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
- Authentication bypass
- Cross-site request forgery (CSRF)
<0.0.0-20260601151442-5c0ca35db828 · fixed in 0.0.0-20260601151442-5c0ca35db828

GHSA-xqhv-chqm-fhcc · CVE-2026-53649 Not analysed yet 8 Jul 2026
CVE-2026-15034 CVE record

CVSS 5.3 Medium

flask-dashboard Flask-MonitoringDashboard cross-site request forgery
- flask-dashboard Flask-MonitoringDashboard
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 8 Jul 2026
CVE-2026-12002 CVE record

CVSS 4.7 Medium

Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter
- smub Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 8 Jul 2026
CVE-2026-9731 CVE record

CVSS 4.3 Medium

Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update
- wpkuf Wp Js Detect
- Cross-site request forgery (CSRF)
Not analysed yet 8 Jul 2026
ha-mcp PyPI

CVSS 6.5 Medium

ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
- Authentication bypass
- Cross-site request forgery (CSRF)
<7.10.0 · fixed in 7.10.0

GHSA-q855-8rh5-jfgq Not analysed yet 7 Jul 2026
open-webui PyPI

CVSS 6.9 Medium

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)
- Cross-site request forgery (CSRF)
<0.3.16 · fixed in 0.3.16

GHSA-p5vx-9hj8-cf4h · CVE-2024-7035 Not analysed yet 7 Jul 2026
github.com/QuantumNous/new-api Go

CVSS 5.3 Medium

New API is vulnerable to CSRF through user email binding
- Cross-site request forgery (CSRF)
<0.12.0-alpha.1 · fixed in 0.12.0-alpha.1

GHSA-26v7-h57m-gh9m · CVE-2026-44342 Not analysed yet 7 Jul 2026
CVE-2026-58315 CVE record

CVSS 5.1 Medium

Cross-site request forgery in SEIKO EPSON CORPORATION Web Config
- SEIKO EPSON CORPORATION Web Config
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jul 2026
CVE-2026-34171 CVE record

CVSS 8.0 High

Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value
- coollabsio coolify
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jul 2026
CVE-2026-59713 CVE record

CVSS 8.6 High

Leantime - OIDC Login CSRF via Unconditional State Verification Stub
- Leantime
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jul 2026
CVE-2026-14800 CVE record

CVSS 5.3 Medium

imhamzaazam ecommerceFlask cross-site request forgery
- imhamzaazam ecommerceFlask
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 6 Jul 2026
CVE-2026-59520 CVE record

CVSS 4.3 Medium

WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability
- properfraction CrawlWP SEO
- Cross-site request forgery (CSRF)
Not analysed yet 5 Jul 2026
CVE-2026-12740 CVE record

CVSS 8.1 High

Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter
- CORNELIUS Plack::Middleware::OAuth
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jul 2026
CVE-2026-12746 CVE record

CVSS 8.1 High

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter
- BIAFRA Dancer2::Plugin::Auth::OAuth::Provider
- Cross-site request forgery (CSRF)
Not analysed yet 4 Jul 2026
CVE-2026-57766 CVE record

CVSS 8.8 High

WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability
- XplodedThemes WPIDE – File Manager & Code Editor
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jul 2026
CVE-2026-57761 CVE record

CVSS 7.1 High

WordPress SEOWP theme <= 3.12.2 - CSRF to Stored XSS vulnerability
- BlueAstralThemes SEOWP
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jul 2026
CVE-2026-57759 CVE record

CVSS 8.8 High

WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability
- Metagauss ProfileGrid
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jul 2026
CVE-2026-57758 CVE record

CVSS 7.1 High

WordPress Permalink Manager for WooCommerce plugin <= 1.0.8.2 - CSRF to Stored XSS vulnerability
- BeRocket Permalink Manager for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jul 2026
CVE-2026-57757 CVE record

CVSS 7.1 High

WordPress pCloud WP Backup plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability
- ploudapp pCloud WP Backup
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jul 2026
CVE-2026-57751 CVE record

CVSS 8.1 High

WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability
- Heateor Support Heateor Social Login
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jul 2026
CVE-2026-57747 CVE record

CVSS 6.5 Medium

WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeREX Booked
- Cross-site request forgery (CSRF)
Not analysed yet 2 Jul 2026