Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-84024 CVE record

CVSS 4.3 Medium

BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF
- BEAR
- Cross-site request forgery (CSRF)
Not analysed yet 12 Sept 2026
CVE-2026-84023 CVE record

CVSS 6.5 Medium

BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF
- BEAR
- Cross-site request forgery (CSRF)
Not analysed yet 12 Sept 2026
CVE-2026-81090 CVE record

CVSS 7.2 High

Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRF
- Gpx2Graphics
- Cross-site request forgery (CSRF)
- Unrestricted file upload
Not analysed yet 12 Sept 2026
@mockoon/cli +1 npm

CVSS 8.8 High

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft
- Authentication bypass
- Cross-site request forgery (CSRF)
<9.7.0 · fixed in 9.7.0

GHSA-rqx4-3f6q-3x2v · CVE-2026-59148 Not analysed yet 11 Sept 2026
CVE-2026-50025 CVE record

CVSS 6.9 Medium

Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state
- t-mart mousehole
- Information disclosure
- Authentication bypass
Not analysed yet 11 Sept 2026
CVE-2026-81907 CVE record

CVSS 6.1 Medium

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery (CSRF) vin Express delete_entries allowing mass deletion of all entity records
- Concrete CMS
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2026
CVE-2026-68526 CVE record

CVSS 5.3 Medium

Concrete CMS before 9.5.3 is vulnerable to CSRF in the Calendar event duplicate dialog controller
- Concrete CMS
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2026
CVE-2026-81912 CVE record

CVSS 5.7 Medium

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature
- Concrete CMS
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2026
CVE-2026-62139 CVE record

CVSS 4.3 Medium

WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability
- Site Kit by Google
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2026
CVE-2026-62133 CVE record

CVSS 5.4 Medium

WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- rometheme RTMKit
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2026
CVE-2026-89245 CVE record

CVSS 7.1 High

WWBN AVideo Cross-Site Request Forgery via playlistRemove.php
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2026
CVE-2026-89148 CVE record

CVSS 5.1 Medium

AVideo Open Redirect via playlistSort.php Referer Header
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 11 Sept 2026
CVE-2026-80380 CVE record

CVSS 7.1 High

DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- IBM DataStage on Cloud Pak for Data
- Cross-site request forgery (CSRF)
Not analysed yet 10 Sept 2026
CVE-2026-84432 CVE record

CVSS 5.3 Medium

Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller
- Concrete CMS
- Cross-site request forgery (CSRF)
Not analysed yet 10 Sept 2026
CVE-2026-88061 CVE record

CVSS 5.8 Medium

career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution
- santifer career-ops
- Cross-site request forgery (CSRF)
- CWE-1385
Not analysed yet 10 Sept 2026
CVE-2026-88873 CVE record

CVSS 7.1 High

WWBN AVideo Cross-Site Request Forgery via logArchive.json.php
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 10 Sept 2026
CVE-2026-88872 CVE record

CVSS 7.1 High

AVideo CustomizeUser setPassword.json.php CSRF
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 10 Sept 2026
CVE-2026-88871 CVE record

CVSS 5.3 Medium

WWBN AVideo CustomizeUser setSubscribers CSRF via GET
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 10 Sept 2026
CVE-2026-88870 CVE record

CVSS 7.1 High

WWBN AVideo LoginControl PGP Key CSRF via GET Request
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 10 Sept 2026
CVE-2026-78083 CVE record

CVSS 7.1 High

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4
- joomshaper.com SP Property extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 10 Sept 2026
CVE-2026-78084 CVE record

CVSS 6.9 Medium

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4
- joomshaper.com SP Property extension for Joomla
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 10 Sept 2026
CVE-2026-87449 CVE record

CVSS 4.3 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 9 Sept 2026
CVE-2026-9215 CVE record

CVSS 1.8 Low

A CSRF vulnerability exists in certain NETGEAR XR series devices
- NETGEAR XR1000v2
- NETGEAR XR500
- Cross-site request forgery (CSRF)
Not analysed yet 8 Sept 2026
CVE-2026-86724 CVE record

CVSS 7.1 High

AVideo YPTWallet saveBalance.php Cross-Site Request Forgery
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 8 Sept 2026
CVE-2026-86719 CVE record

CVSS 5.3 Medium

WWBN AVideo CustomizeUser Cross-Site Request Forgery Session Hijacking
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 8 Sept 2026
CVE-2026-86718 CVE record

CVSS 7.1 High

WWBN AVideo Cross-Site Request Forgery via deleteHistory.json.php
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 8 Sept 2026
CVE-2026-86135 CVE record

CVSS 7.0 High

Dimension CSRF Vulnerability in Database Snapshot Creation Allows Denial of Service
- WatchGuard Dimension
- Cross-site request forgery (CSRF)
- Denial of service
Not analysed yet 8 Sept 2026
CVE-2026-33920 CVE record

CVSS 5.1 Medium

Cross-site request forgery in the Guardian/CMC login before 26.3.0
- Nozomi Networks Guardian
- Nozomi Networks CMC
- Cross-site request forgery (CSRF)
Not analysed yet 8 Sept 2026
CVE-2026-76961 CVE record

CVSS 3.5 Low

Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
- SAP_SE SAP S/4HANA (Finance for Advanced Payment Management)
- Cross-site request forgery (CSRF)
Not analysed yet 8 Sept 2026
CVE-2026-76960 CVE record

CVSS 3.5 Low

Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
- SAP_SE SAP S/4HANA (Finance for Advanced Payment Management)
- Cross-site request forgery (CSRF)
Not analysed yet 8 Sept 2026
CVE-2026-76959 CVE record

CVSS 4.6 Medium

Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management)
- SAP_SE SAP S/4HANA (Finance for Advanced Payment Management)
- Cross-site request forgery (CSRF)
Not analysed yet 8 Sept 2026
CVE-2026-86307 CVE record

CVSS 5.3 Medium

light0011 cms cross-site request forgery
- light0011 cms
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 7 Sept 2026
CVE-2026-86281 CVE record

CVSS 5.3 Medium

SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery
- SourceCodester Syllabus-Aligned Learning Management & Examination System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 7 Sept 2026
CVE-2026-86182 CVE record

CVSS 5.3 Medium

diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery
- diem
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 6 Sept 2026
CVE-2026-82712 CVE record

CVSS 8.6 High

Tycon Systems TPDIN-Monitor-WEB3 Cross-Site Request Forgery
- Tycon Systems TPDIN-Monitor-WEB3
- Cross-site request forgery (CSRF)
Not analysed yet 4 Sept 2026
CVE-2026-82911 CVE record

CVSS 5.1 Medium

CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes
- Roskus Prospero Flow CRM
- Cross-site request forgery (CSRF)
Not analysed yet 4 Sept 2026
CVE-2026-85547 CVE record

CVSS 6.2 Medium

Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP
- misp
- Cross-site request forgery (CSRF)
Not analysed yet 4 Sept 2026
CVE-2026-85546 CVE record

CVSS 8.6 High

MISP Sharing Group Quick-Edit Actions Allow CSRF via State-Changing GET Requests
- misp
- Cross-site request forgery (CSRF)
Not analysed yet 4 Sept 2026
claude-code-templates npm

CVSS 8.8 High

Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
- Command injection
- Authentication bypass
<1.29.4 · fixed in 1.29.4

GHSA-79wm-x847-7cvg · CVE-2026-73222 Not analysed yet 3 Sept 2026
github.com/semaphoreui/semaphore Go

CVSS 8.3 High

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
- Cross-site request forgery (CSRF)
- CWE-620
<0.0.0-20260707190631-c59c3dc9035b · fixed in 0.0.0-20260707190631-c59c3dc9035b

GHSA-8cj9-r88m-8945 · CVE-2026-73292 Not analysed yet 3 Sept 2026
CVE-2026-85236 CVE record

CVSS 8.8 High

MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request
- misp
- Cross-site request forgery (CSRF)
Not analysed yet 3 Sept 2026
CVE-2026-85162 CVE record

CVSS 7.1 High

AVideo through c91b5975d CSRF via saveLive.php
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 3 Sept 2026
CVE-2026-85161 CVE record

CVSS 5.3 Medium

AVideo removePoster.php Cross-Site Request Forgery File Deletion
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 3 Sept 2026
CVE-2026-84663 CVE record

CVSS 5.4 Medium

Cross-site request forgery in Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin
- Jenkins Project Jenkins Pipeline: Groovy Libraries Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 2 Sept 2026
CVE-2026-84649 CVE record

CVSS 8.8 High

Cross-site request forgery in Jenkins
- Jenkins
- Cross-site request forgery (CSRF)
Not analysed yet 2 Sept 2026
studio-42/elfinder Packagist

CVSS 5.4 Medium

elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
- Cross-site request forgery (CSRF)
<2.1.70 · fixed in 2.1.70

GHSA-9hjf-w35w-6vx2 · CVE-2026-81890 Not analysed yet 2 Sept 2026
CVE-2026-8151 CVE record

CVSS 5.4 Medium

Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF
- Simple Membership MailChimp Integration
- Cross-site request forgery (CSRF)
Not analysed yet 2 Sept 2026
CVE-2026-66652 CVE record

CVSS 5.4 Medium

WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability
- ThemeGoods Grand Tour
- Cross-site request forgery (CSRF)
Not analysed yet 2 Sept 2026
CVE-2026-84770 CVE record

CVSS 8.8 High

WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability
- Kitae Park Mang Board WP
- Cross-site request forgery (CSRF)
Not analysed yet 2 Sept 2026
CVE-2026-84764 CVE record

CVSS 8.8 High

WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability
- NSquared Simply Schedule Appointments
- Cross-site request forgery (CSRF)
Not analysed yet 2 Sept 2026
CVE-2026-84759 CVE record

CVSS 7.1 High

WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability
- Elementor Activity Log
- Cross-site request forgery (CSRF)
Not analysed yet 2 Sept 2026
CVE-2026-81432 CVE record

CVSS 4.3 Medium

JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF
- JetStyleManager for Gutenberg
- Cross-site request forgery (CSRF)
Not analysed yet 2 Sept 2026
CVE-2026-81426 CVE record

CVSS 4.3 Medium

WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
- WC Vendors
- Cross-site request forgery (CSRF)
Not analysed yet 2 Sept 2026
typo3/cms-backend +1 Packagist

CVSS 7.3 High

TYPO3 CMS - Broken Access Control in Backend and Install Tool
- Cross-site request forgery (CSRF)
- CWE-346
>=13.0.0, <13.4.34 · fixed in 13.4.34

GHSA-68jx-f42c-7599 · CVE-2026-19418 Not analysed yet 1 Sept 2026
CVE-2026-73780 CVE record

CVSS 8.3 High

Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX
- Hewlett Packard Enterprise (HPE) AOS-CX
- Cross-site request forgery (CSRF)
Not analysed yet 1 Sept 2026
CVE-2026-73718 CVE record

CVSS 7.4 High

Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer
- Hewlett Packard Enterprise (HPE) Fabric Composer
- Cross-site request forgery (CSRF)
Not analysed yet 1 Sept 2026
CVE-2026-18780 CVE record

CVSS 7.1 High

CSRF in TMT Machine's Talassoft Industrial Management Software
- TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software
- Cross-site request forgery (CSRF)
Not analysed yet 1 Sept 2026
CVE-2026-83595 CVE record

CVSS 7.2 High

AVideo Cross-Site Request Forgery via plugin/API/set.json.php
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 1 Sept 2026
@hono/oauth-providers npm

CVSS 5.4 Medium

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
- Cross-site request forgery (CSRF)
- CWE-1275
<0.8.6 · fixed in 0.8.6

GHSA-fm3f-ch8h-qw8q · CVE-2026-81888 Not analysed yet 31 Aug 2026
CVE-2026-54599 CVE record

CVSS 7.5 High

Wallos: OIDC state parameter never validated — login CSRF / account takeover
- ellite Wallos
- Cross-site request forgery (CSRF)
Not analysed yet 31 Aug 2026