Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-86066 CVE record

CVSS 5.9 Medium

Horilla attendance approval endpoint is vulnerable to cross-site request forgery
- horilla-hr
- Cross-site request forgery (CSRF)
Not analysed yet 25 Sept 2026
CVE-2026-84463 CVE record

CVSS 6.3 Medium

Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute
- zammad
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 25 Sept 2026
CVE-2026-56732 CVE record

CVSS 5.3 Medium

Zammad: Malicious input in Ticket Body Enables Session Termination
- zammad
- Cross-site request forgery (CSRF)
- CWE-20
Not analysed yet 25 Sept 2026
CVE-2026-85289 CVE record

CVSS 6.5 Medium

InvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints
- InvoicePlane
- Cross-site request forgery (CSRF)
Not analysed yet 25 Sept 2026
CVE-2026-85274 CVE record

CVSS 6.5 Medium

InvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection
- InvoicePlane
- Cross-site request forgery (CSRF)
Not analysed yet 25 Sept 2026
CVE-2026-62062 CVE record

CVSS 8.8 High

WordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- Elementor Website Builder
- Cross-site request forgery (CSRF)
Not analysed yet 25 Sept 2026
CVE-2026-97648 CVE record

CVSS 5.3 Medium

ningzichun student-management-system cross-site request forgery
- ningzichun student-management-system
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 25 Sept 2026
social-auth-core PyPI

CVSS 4.3 Medium

social-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend
- Cross-site request forgery (CSRF)
<5.0.0 · fixed in 5.0.0

GHSA-x7qq-23vw-7pfg · CVE-2026-57177 Not analysed yet 24 Sept 2026
CVE-2026-96551 CVE record

CVSS 5.3 Medium

sfturing hosp_order CommonUserController.java cross-site request forgery
- sfturing hosp_order
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 23 Sept 2026
CVE-2026-90903 CVE record

CVSS 7.2 High

Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0
- joomshaper.com Easy Store extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 23 Sept 2026
CVE-2026-90905 CVE record

CVSS 7.2 High

Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0
- joomshaper.com Easy Store extension for Joomla
- Broken access control
- Cross-site request forgery (CSRF)
Not analysed yet 23 Sept 2026
CVE-2026-90900 CVE record

CVSS 5.3 Medium

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0
- joomshaper.com Easy Store extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 23 Sept 2026
CVE-2026-94487 CVE record

CVSS 8.1 High

WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability
- PublishPress Capabilities
- Cross-site request forgery (CSRF)
Not analysed yet 23 Sept 2026
redaxo/source Packagist

CVSS 6.4 Medium

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
- Cross-site request forgery (CSRF)
<5.21.2 · fixed in 5.21.2

GHSA-m8r3-22v6-g877 · CVE-2026-63000 Not analysed yet 23 Sept 2026
CVE-2026-75743 CVE record

CVSS 7.1 High

Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352)
- Adobe AEM 6.5 Forms JEE
- Adobe AEM 6.5 LTS Forms JEE
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2026
CVE-2026-95658 CVE record

CVSS 6.9 Medium

MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules
- MISP
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2026
CVE-2026-88418 CVE record

CVSS 8.8 High

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not send the csrf_token hidden field in admi…
- Cross-site request forgery (CSRF)
Not analysed yet 22 Sept 2026
CVE-2026-63373 CVE record

CVSS 4.2 Medium

draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows session token injection
- jgraph drawio
- Cross-site request forgery (CSRF)
Not analysed yet 21 Sept 2026
github.com/hatchet-dev/hatchet Go

CVSS 7.1 High

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
- Authentication bypass
- Cross-site request forgery (CSRF)
<0.91.1 · fixed in 0.91.1

GHSA-phg3-3g28-wq9v · CVE-2026-61687 Not analysed yet 21 Sept 2026
CVE-2026-94404 CVE record

CVSS 7.1 High

MISP CSRF vulnerability allows unauthorized attribute modification
- MISP
- Cross-site request forgery (CSRF)
Not analysed yet 21 Sept 2026
CVE-2026-92410 CVE record

CVSS 4.3 Medium

Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRF
- Sign-up Sheets
- Cross-site request forgery (CSRF)
Not analysed yet 20 Sept 2026
CVE-2026-93873 CVE record

CVSS 5.3 Medium

Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin
- Cotonti
- Cross-site request forgery (CSRF)
Not analysed yet 18 Sept 2026
CVE-2026-93870 CVE record

CVSS 5.3 Medium

Cotonti through 1.0.0 Cross-Site Request Forgery in the Ratings Plugin AJAX Handler
- Cotonti
- Cross-site request forgery (CSRF)
Not analysed yet 18 Sept 2026
CVE-2026-84084 CVE record

CVSS 8.8 High

IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site request forgery (CSRF)
Not analysed yet 18 Sept 2026
CVE-2026-84077 CVE record

CVSS 8.1 High

IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site request forgery (CSRF)
Not analysed yet 18 Sept 2026
CVE-2025-15399 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
- IBM Common Licensing
- Cross-site request forgery (CSRF)
Not analysed yet 18 Sept 2026
CVE-2026-93531 CVE record

CVSS 5.3 Medium

gedelumbung HospitalManagement cross-site request forgery
- gedelumbung HospitalManagement
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 18 Sept 2026
CVE-2026-93456 CVE record

CVSS 8.4 High

django-page-cms through 2.0.13 CSRF via admin mutation views
- batiste django-page-cms
- Cross-site request forgery (CSRF)
Not analysed yet 18 Sept 2026
CVE-2026-54642 CVE record

CVSS 5.3 Medium

CubeCart: CSRF Protection Missing for Download Resets and Card Deletions in orders.index.inc.php
- cubecart v6
- Cross-site request forgery (CSRF)
Not analysed yet 17 Sept 2026
CVE-2026-54510 CVE record

CVSS 7.1 High

Speakr: CSRF bypass via unauthenticated API token parameter in csrf_exempt_for_api_tokens hook
- murtaza-nasir speakr
- Authentication bypass
- Cross-site request forgery (CSRF)
Not analysed yet 17 Sept 2026
CVE-2026-80355 CVE record

CVSS 5.4 Medium

Cross-site request forgery in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others
- Dell OpenManage Server Administrator Managed Node (Patch) for Windows
- Dell OpenManage Server Administrator Managed Node for RHEL 8.10
- Cross-site request forgery (CSRF)
Not analysed yet 17 Sept 2026
CVE-2026-78295 CVE record

CVSS 8.8 High

WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability
- Xagio SEO
- Cross-site request forgery (CSRF)
Not analysed yet 17 Sept 2026
CVE-2026-74005 CVE record

CVSS 5.4 Medium

WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
- PublishPress Series
- Cross-site request forgery (CSRF)
Not analysed yet 17 Sept 2026
CVE-2026-66571 CVE record

CVSS 7.1 High

WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability
- Gabe Livan Asset CleanUp: Page Speed Booster
- Cross-site request forgery (CSRF)
Not analysed yet 17 Sept 2026
CVE-2026-91009 CVE record

CVSS 4.3 Medium

Active Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment
- Active Woot Products Tables for WooCommerce. 100% FREE
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 17 Sept 2026
CVE-2026-92582 CVE record

CVSS 7.1 High

AVideo through 29.0 Broken Access Control via videoAddNew.json.php CSRF Bypass
- WWBN AVideo
- Cross-site request forgery (CSRF)
Not analysed yet 16 Sept 2026
CVE-2026-92806 CVE record

CVSS 7.2 High

phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
- phpList
- Cross-site request forgery (CSRF)
Not analysed yet 16 Sept 2026
CVE-2026-92751 CVE record

CVSS 7.2 High

CMAK through 3.0.0.6 Cross-Site Request Forgery via Missing CSRF Filter
- yahoo CMAK
- Cross-site request forgery (CSRF)
Not analysed yet 16 Sept 2026
djust PyPI

CVSS 8.1 High

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
- Cross-site request forgery (CSRF)
<1.0.7 · fixed in 1.0.7

GHSA-pg97-jvmf-qfvc · CVE-2026-61593 Not analysed yet 16 Sept 2026
CVE-2026-92383 CVE record

CVSS 5.3 Medium

PbootCMS User Management UserController.php mod cross-site request forgery
- PbootCMS
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 16 Sept 2026
CVE-2026-19535 CVE record

CVSS 8.6 High

Cross-site request forgery in Advantech EKI-1242IEIMS and others
- Advantech EKI-1242IEIMS
- Advantech EKI-1242EIMS
- Cross-site request forgery (CSRF)
Not analysed yet 16 Sept 2026
CVE-2026-40857 CVE record

CVSS 8.4 High

CSRF token bypass in T-Mobile 5G Box IDU routers
- WNC T-Mobile 5G Box IDU
- Cross-site request forgery (CSRF)
Not analysed yet 16 Sept 2026
CVE-2026-85131 CVE record

CVSS 6.5 Medium

WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF
- WPLP Cookie Consent
- Cross-site request forgery (CSRF)
Not analysed yet 16 Sept 2026
CVE-2026-76856 CVE record

CVSS 7.0 High

Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints
- Netcore NR255-V
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2026
CVE-2026-87132 CVE record

CVSS 7.6 High

Cross-site request forgery in Oracle Corporation Oracle Hyperion Data Relationship Management
- Oracle Corporation Oracle Hyperion Data Relationship Management
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2026
CVE-2026-83126 CVE record

CVSS 7.6 High

Cross-site request forgery in Oracle Corporation Oracle Sales Online
- Oracle Corporation Oracle Sales Online
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2026
CVE-2026-18425 CVE record

CVSS 2.1 Low

IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages
- Concrete CMS
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 15 Sept 2026
CVE-2026-81924 CVE record

CVSS 2.1 Low

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation
- Concrete CMS
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2026
CVE-2026-78081 CVE record

CVSS 7.1 High

Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
- j2commerce.com J2Store extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2026
CVE-2026-81920 CVE record

CVSS 2.3 Low

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint
- Concrete CMS
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2026
CVE-2026-68532 CVE record

CVSS 2.3 Low

Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action
- Concrete CMS
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2026
CVE-2026-81919 CVE record

CVSS 2.3 Low

Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint
- Concrete CMS
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2026
CVE-2026-81897 CVE record

CVSS 7.7 High

Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control
- Concrete CMS
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2026
CVE-2026-91857 CVE record

CVSS 5.3 Medium

MISP: State-changing actions accessible via GET request enabling CSRF
- MISP
- Cross-site request forgery (CSRF)
Not analysed yet 15 Sept 2026
CVE-2026-91819 CVE record

CVSS 6.9 Medium

MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
- MISP
- Cross-site request forgery (CSRF)
- CWE-20
Not analysed yet 15 Sept 2026
CVE-2026-81902 CVE record

CVSS 7.1 High

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
- Concrete CMS
- Cross-site request forgery (CSRF)
Not analysed yet 14 Sept 2026
CVE-2026-17047 CVE record

CVSS 5.4 Medium

IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery []
- IBM Db2 Mirror for i
- Cross-site request forgery (CSRF)
Not analysed yet 14 Sept 2026
CVE-2026-90893 CVE record

CVSS 5.1 Medium

MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints
- MISP
- Cross-site request forgery (CSRF)
Not analysed yet 14 Sept 2026
CVE-2026-82764 CVE record

CVSS 5.1 Medium

Cross-site request forgery in Contec Co., Ltd. FXA5000 and others
- Contec Co., Ltd. FXA5000
- Contec Co., Ltd. FXA5020
- Cross-site request forgery (CSRF)
Not analysed yet 14 Sept 2026
CVE-2026-90599 CVE record

CVSS 5.3 Medium

Rizwan17 inventory-management-system process.php cross-site request forgery
- Rizwan17 inventory-management-system
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 13 Sept 2026