Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-71378 CVE record

CVSS 4.6 Medium

Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener
- Apache Software Foundation Apache Wicket
- Cross-site request forgery (CSRF)
Not analysed yet 31 Aug 2026
CVE-2026-82647 CVE record

CVSS 5.3 Medium

WWBN AVideo Cross-Site Request Forgery via sendEmail.json.php
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 30 Aug 2026
CVE-2026-82544 CVE record

CVSS 5.3 Medium

wger-project wger Password Reset gym.py reset_user_password cross-site request forgery
- wger
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 30 Aug 2026
CVE-2026-82468 CVE record

CVSS 4.9 Medium

Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type
- jeremyevans rodauth
- Cross-site request forgery (CSRF)
Not analysed yet 29 Aug 2026
CVE-2026-17522 CVE record

CVSS 5.4 Medium

Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF
- Newsletters
- Cross-site request forgery (CSRF)
Not analysed yet 29 Aug 2026
CVE-2026-81733 CVE record

CVSS 5.1 Medium

WWBN AVideo through 30.0 CSRF via myLiveControls.save.json.php
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 28 Aug 2026
CVE-2026-78610 CVE record

CVSS 8.4 High

Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
- WatchGuard Dimension
- Cross-site request forgery (CSRF)
Not analysed yet 27 Aug 2026
CVE-2026-75814 CVE record

CVSS 8.6 High

Ebyte NA111-M Cross-Site Request Forgery
- Ebyte NA111-M Firmware
- Cross-site request forgery (CSRF)
Not analysed yet 27 Aug 2026
CVE-2026-80210 CVE record

CVSS 7.1 High

FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms
- FrontAccounting
- Cross-site request forgery (CSRF)
Not analysed yet 27 Aug 2026
CVE-2026-81273 CVE record

CVSS 8.1 High

WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
- WP Manage Ninja FluentBooking Pro
- Cross-site request forgery (CSRF)
Not analysed yet 27 Aug 2026
CVE-2026-81271 CVE record

CVSS 8.8 High

WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability
- Paolo GeoDirectory
- Cross-site request forgery (CSRF)
Not analysed yet 27 Aug 2026
CVE-2026-76549 CVE record

CVSS 5.9 Medium

UpdraftPlus < 1.26.7 - Backup Restoration via CSRF
- UpdraftPlus: WP Backup & Migration Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 27 Aug 2026
CVE-2026-48549 CVE record

CVSS 6.9 Medium

Nagios Core / XI CSRF via cmd.cgi Double-Submit Cookie
- Nagios Enterprises, LLC. Nagios Core
- Nagios Enterprises, LLC. Nagios XI
- Cross-site request forgery (CSRF)
Not analysed yet 26 Aug 2026
CVE-2026-48548 CVE record

CVSS 6.9 Medium

Nagios Core CSRF via cmd.cgi
- Nagios Enterprises, LLC. Nagios Core
- Cross-site request forgery (CSRF)
Not analysed yet 26 Aug 2026
CVE-2025-56798 CVE record

CVSS 8.8 High

Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's…
- Cross-site request forgery (CSRF)
Not analysed yet 26 Aug 2026
praisonai PyPI

CVSS 7.6 High

PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server
- Cross-site request forgery (CSRF)
- CWE-346
<4.6.58 · fixed in 4.6.58

GHSA-pvph-5j39-v8qc · CVE-2026-55532 Not analysed yet 25 Aug 2026
CVE-2026-78280 CVE record

CVSS 4.3 Medium

WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
- HashThemes Hash Form
- Cross-site request forgery (CSRF)
Not analysed yet 24 Aug 2026
CVE-2026-78279 CVE record

CVSS 5.4 Medium

WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- WP ManageNinja LLC Fluent Support Pro
- Cross-site request forgery (CSRF)
Not analysed yet 24 Aug 2026
CVE-2026-58003 CVE record

CVSS 7.1 High

WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.json.php
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 22 Aug 2026
CVE-2026-58001 CVE record

CVSS 6.9 Medium

WWBN AVideo Cross-Site Request Forgery via videoEditLight.php
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 22 Aug 2026
CVE-2026-57944 CVE record

CVSS 5.3 Medium

AVideo channelToGallery.json.php Cross-Site Request Forgery
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 22 Aug 2026
CVE-2026-67361 CVE record

CVSS 6.9 Medium

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Cross-site request forgery (CSRF)
- Information disclosure
Not analysed yet 21 Aug 2026
CVE-2026-67358 CVE record

CVSS 5.3 Medium

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 21 Aug 2026
CVE-2026-77029 CVE record

CVSS 4.6 Medium

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66
- yootheme.com Zoo extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 21 Aug 2026
CVE-2026-15046 CVE record

CVSS 4.2 Medium

LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF
- LitExtension
- Cross-site request forgery (CSRF)
Not analysed yet 21 Aug 2026
CVE-2026-77391 CVE record

CVSS 5.3 Medium

SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery
- SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 21 Aug 2026
winter/wn-backend-module Packagist

CVSS 6.1 Medium

Winter: CSRF through AJAX handler names reachable as backend page actions
- Cross-site request forgery (CSRF)
>=1.0.319, <1.2.14 · fixed in 1.2.14

GHSA-p2ch-c2c3-4xm5 Not analysed yet 20 Aug 2026
CVE-2026-66001 CVE record

CVSS 8.5 High

Frappe: Improper Authorization in OAuth2 Consent Endpoint
- frappe
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2026
CVE-2026-63654 CVE record

CVSS 6.9 Medium

Frappe: Unauthenticated Workflow approval via confirm_action
- frappe
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2026
CVE-2026-64962 CVE record

CVSS 5.1 Medium

Cross-Site Request Forgery (CSRF) in ATutor
- ATutor
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2026
CVE-2026-28164 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
- HashThemes Easy Elementor Addons
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2026
CVE-2026-76610 CVE record

CVSS 6.9 Medium

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65
- yootheme.com Zoo extension for Joomla
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2026
CVE-2026-14951 CVE record

CVSS 8.6 High

Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers
- Frauscher Sensortechnik FDS 102
- Cross-site request forgery (CSRF)
Not analysed yet 20 Aug 2026
@tinacms/cli npm

CVSS 6.5 Medium

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
- Cross-site request forgery (CSRF)
<2.5.2 · fixed in 2.5.2

GHSA-rgr9-r7mj-mf6x · CVE-2026-63123 Not analysed yet 19 Aug 2026
CVE-2026-76334 CVE record

CVSS 6.4 Medium

SPL Injection through Dashboard Studio Workflow Actions in Splunk Enterprise
- Splunk Enterprise
- Cross-site request forgery (CSRF)
Not analysed yet 19 Aug 2026
CVE-2026-18848 CVE record

CVSS 8.3 High

Power System Cross-Site Request Forgery (CSRF)
- IBM Power Systems Firmware
- Cross-site request forgery (CSRF)
Not analysed yet 19 Aug 2026
CVE-2026-62671 CVE record

CVSS 5.4 Medium

CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)
- getgrav grav-plugin-login
- Cross-site request forgery (CSRF)
Not analysed yet 19 Aug 2026
CVE-2026-40509 CVE record

CVSS 5.3 Medium

OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter
- openemr
- Cross-site request forgery (CSRF)
Not analysed yet 19 Aug 2026
CVE-2026-75952 CVE record

CVSS 4.6 Medium

Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3
- cmsjunkie.com J-BusinessDirectory extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 19 Aug 2026
CVE-2026-71694 CVE record

CVSS 8.8 High

An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code via the CSR trap-return stat…
- Cross-site request forgery (CSRF)
Not analysed yet 19 Aug 2026
CVE-2026-66602 CVE record

CVSS 8.8 High

WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability
- DevItems HashBar – WordPress Notification Bar
- Cross-site request forgery (CSRF)
Not analysed yet 18 Aug 2026
CVE-2026-71123 CVE record

CVSS 5.4 Medium

Cross-site request forgery in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Cross-site request forgery (CSRF)
Not analysed yet 18 Aug 2026
froxlor/froxlor Packagist

CVSS 6.5 Medium

Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery Protection
- Cross-site request forgery (CSRF)
<2.3.8 · fixed in 2.3.8

GHSA-xpr4-8vp6-c87j · CVE-2026-55593 Not analysed yet 18 Aug 2026
mobsf PyPI

CVSS 6.5 Medium

MobSF's CSRF checks not enforced after Django migration
- Cross-site request forgery (CSRF)
<4.5.1 · fixed in 4.5.1

GHSA-3p54-567p-2wpr · CVE-2026-68923 Not analysed yet 18 Aug 2026
CVE-2026-45129 CVE record

CVSS 4.6 Medium

MyBB: ACP Recovery Codes CSRF
- mybb
- Cross-site request forgery (CSRF)
Not analysed yet 18 Aug 2026
CVE-2026-45119 CVE record

CVSS 4.6 Medium

MyBB: ACP UTF-8 Conversion CSRF
- mybb
- Cross-site request forgery (CSRF)
Not analysed yet 18 Aug 2026
CVE-2026-45126 CVE record

CVSS 3.5 Low

MyBB: ACP Questions state CSRF
- mybb
- Cross-site request forgery (CSRF)
Not analysed yet 18 Aug 2026
CVE-2026-45128 CVE record

CVSS 3.5 Low

MyBB: ACP Users View Manager default CSRF
- mybb
- Cross-site request forgery (CSRF)
Not analysed yet 18 Aug 2026
CVE-2026-45127 CVE record

CVSS 3.5 Low

MyBB: ACP Mass Mail draft resend CSRF
- mybb
- Cross-site request forgery (CSRF)
Not analysed yet 18 Aug 2026
CVE-2026-66635 CVE record

CVSS 7.4 High

WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerability
- Slider by 10Web
- Cross-site request forgery (CSRF)
Not analysed yet 18 Aug 2026
CVE-2026-75151 CVE record

CVSS 5.3 Medium

SourceCodester Onlne Examination & Learning Management System cross-site request forgery
- SourceCodester Onlne Examination & Learning Management System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 18 Aug 2026
CVE-2026-67921 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components.
- Cross-site request forgery (CSRF)
Not analysed yet 18 Aug 2026
CVE-2026-19650 CVE record

CVSS 7.1 High

Cross-Site Request Forgery (CSRF) in GitLab
- GitLab
- Cross-site request forgery (CSRF)
Not analysed yet 17 Aug 2026
CVE-2026-74867 CVE record

CVSS 2.3 Low

SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth
- siyuan
- Cross-site request forgery (CSRF)
Not analysed yet 17 Aug 2026
CVE-2026-17608 CVE record

CVSS 6.5 Medium

WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion
- aresit WP Compress – Instant Performance & Speed Optimization
- Cross-site request forgery (CSRF)
Not analysed yet 16 Aug 2026
CVE-2026-15384 CVE record

CVSS 5.7 Medium

Manual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR
- Manual Image Crop
- Authentication bypass
- Cross-site request forgery (CSRF)
Not analysed yet 16 Aug 2026
CVE-2026-18165 CVE record

CVSS 4.2 Medium

@fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies
- @fastify/oauth2
- Cross-site request forgery (CSRF)
Not analysed yet 15 Aug 2026
CVE-2026-67366 CVE record

CVSS 5.3 Medium

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11
- icagenda.com iCagenda extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2026
CVE-2026-73847 CVE record

CVSS 6.8 Medium

Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover
- emlog
- Cross-site request forgery (CSRF)
- Hard-coded credentials
Not analysed yet 14 Aug 2026
CVE-2026-57469 CVE record

CVSS 5.1 Medium

Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory
- KUNBUS PiCtory
- Cross-site request forgery (CSRF)
Not analysed yet 14 Aug 2026