Advisories · Weakness

Cross-site request forgery (CSRF).

A signed-in user’s browser made to send requests they didn’t intend. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-108553 CVE record

CVSS 7.7 High

OpenRefine through 3.10.1 CSRF to RCE via get-rows Command
- OpenRefine
- Cross-site request forgery (CSRF)
Not analysed yet 10 Oct 2026
contao/core-bundle Packagist

CVSS 3.5 Low

Contao: Cross-site request forgery in custom backend actions
- Cross-site request forgery (CSRF)
>=4.0.0, <5.3.50 || >=5.4.0-RC1, <5.7.12 · fixed in 5.3.50, 5.7.12

GHSA-9ff2-p842-45wq · CVE-2026-107848 Not analysed yet 9 Oct 2026
github.com/0xJacky/Nginx-UI Go

CVSS 8.8 High

Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
- Cross-site request forgery (CSRF)
>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b · fixed in 1.9.10-0.20260728074433-a3999bd78a3b

GHSA-33rr-wq23-g6gg · CVE-2026-107809 Not analysed yet 9 Oct 2026
CVE-2026-62026 CVE record

CVSS 7.1 High

WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability
- MIGHTYminnow Dashboard Notes
- Cross-site request forgery (CSRF)
Not analysed yet 9 Oct 2026
CVE-2026-85348 CVE record

CVSS 4.3 Medium

GDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRF
- GDPR Data Request Form
- Cross-site request forgery (CSRF)
Not analysed yet 9 Oct 2026
CVE-2026-96671 CVE record

CVSS 8.8 High

WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability
- fifu.app Featured Image from URL
- Cross-site request forgery (CSRF)
Not analysed yet 9 Oct 2026
CVE-2026-107831 CVE record

CVSS 5.3 Medium

Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions
- banq jivejdon
- Cross-site request forgery (CSRF)
Not analysed yet 8 Oct 2026
CVE-2026-78388 CVE record

CVSS 4.3 Medium

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- IBM Security Verify Access
- IBM Verify Identity Access
- Cross-site request forgery (CSRF)
Not analysed yet 8 Oct 2026
CVE-2026-107337 CVE record

CVSS 7.1 High

Cross-Site Request Forgery in Malcolm
- CISA Malcolm
- Cross-site request forgery (CSRF)
Not analysed yet 8 Oct 2026
pydantic-ai +1 PyPI

CVSS 7.6 High

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
- Cross-site request forgery (CSRF)
- CWE-346
>=1.34.0, <1.107.4 || >=2.0.0b1, <2.28.0 · fixed in 1.107.4, 2.28.0

GHSA-h4xc-3qfq-jf93 · CVE-2026-107295 Not analysed yet 8 Oct 2026
CVE-2026-106611 CVE record

CVSS 7.1 High

WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability
- WPMU DEV Forminator
- Cross-site request forgery (CSRF)
Not analysed yet 8 Oct 2026
CVE-2026-102784 CVE record

CVSS 8.7 High

Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0
- balbooa.com Gridbox extension for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 8 Oct 2026
CVE-2026-62142 CVE record

CVSS 8.8 High

WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- Melapress WP 2FA
- Cross-site request forgery (CSRF)
Not analysed yet 8 Oct 2026
CVE-2026-66479 CVE record

CVSS 7.1 High

WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability
- Liquid Web / StellarWP WPComplete
- Cross-site request forgery (CSRF)
Not analysed yet 8 Oct 2026
CVE-2026-105260 CVE record

CVSS 4.3 Medium

Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF
- Database Addon For WPForms ( wpforms entries )
- Cross-site request forgery (CSRF)
Not analysed yet 8 Oct 2026
wger PyPI

CVSS 5.4 Medium

wger: trainer_login accepts GET - CSRF bypass enables forced session rebinding
- Cross-site request forgery (CSRF)
<=2.1 · no fixed version yet

GHSA-xf64-4pmc-h8qf · CVE-2026-45161 Not analysed yet 7 Oct 2026
CVE-2025-70522 CVE record

CVSS 8.8 High

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications.
- Cross-site request forgery (CSRF)
Not analysed yet 7 Oct 2026
CVE-2025-70517 CVE record

CVSS 8.8 High

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications.
- Cross-site request forgery (CSRF)
Not analysed yet 7 Oct 2026
CVE-2026-106216 CVE record

CVSS 5.4 Medium

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 6 Oct 2026
CVE-2026-105706 CVE record

CVSS 5.3 Medium

SourceCodester Drug Recommendation System cross-site request forgery
- SourceCodester Drug Recommendation System
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 6 Oct 2026
CVE-2026-105783 CVE record

CVSS 8.0 High

Joplin Web Clipper pairing allows cross-origin theft of a permanent API token
- laurent22 joplin
- Cross-site request forgery (CSRF)
- CWE-346
Not analysed yet 5 Oct 2026
CVE-2026-102778 CVE record

CVSS 5.3 Medium

Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension < 6.6.0
- svenbluege.de Event Gallery for Joomla
- Cross-site request forgery (CSRF)
- Open redirect
Not analysed yet 5 Oct 2026
CVE-2026-102776 CVE record

CVSS 5.1 Medium

Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0
- svenbluege.de Event Gallery for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 5 Oct 2026
CVE-2026-104407 CVE record

CVSS 7.1 High

WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability
- Blubrry Podcasting PowerPress Podcasting
- Cross-site request forgery (CSRF)
Not analysed yet 5 Oct 2026
CVE-2026-105292 CVE record

CVSS 6.0 Medium

Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback
- Chaterm
- Cross-site request forgery (CSRF)
Not analysed yet 5 Oct 2026
CVE-2026-93549 CVE record

CVSS 8.8 High

CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
- CoCart
- Cross-site request forgery (CSRF)
Not analysed yet 4 Oct 2026
github.com/siyuan-note/siyuan/kernel Go

CVSS 7.1 High

SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass
- Cross-site request forgery (CSRF)
- Server-side request forgery (SSRF)
<0.0.0-20260803045322-cb67e0b4fab5 · fixed in 0.0.0-20260803045322-cb67e0b4fab5

GHSA-3cc2-h3v6-rqpq · CVE-2026-74802 Not analysed yet 2 Oct 2026
CVE-2026-39718 CVE record

CVSS 8.8 High

WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability
- Webriti Wallstreet
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104453 CVE record

CVSS 5.3 Medium

YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104452 CVE record

CVSS 5.3 Medium

YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104451 CVE record

CVSS 5.3 Medium

YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104448 CVE record

CVSS 7.2 High

YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104447 CVE record

CVSS 7.1 High

YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-56662 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request
- GetSimpleCMS-CE
- Cross-site request forgery (CSRF)
Not analysed yet 1 Oct 2026
CVE-2026-56660 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
- GetSimpleCMS-CE
- Cross-site request forgery (CSRF)
- Unrestricted file upload
Not analysed yet 1 Oct 2026
CVE-2026-104059 CVE record

CVSS 7.0 High

Lektor 3.3.14 CSRF via Admin API Endpoints
- lektor
- Cross-site request forgery (CSRF)
Not analysed yet 1 Oct 2026
CVE-2026-103067 CVE record

CVSS 8.0 High

WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability
- Memberful - Membership Plugin
- Cross-site request forgery (CSRF)
Not analysed yet 1 Oct 2026
CVE-2026-94220 CVE record

CVSS 2.1 Low

Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin
- Apache Software Foundation Apache APISIX
- Cross-site request forgery (CSRF)
Not analysed yet 1 Oct 2026
CVE-2026-103285 CVE record

CVSS 5.3 Medium

Ghost 5.19.0 before 6.57.1 Cross-Site Request Forgery
- Ghost
- Cross-site request forgery (CSRF)
Not analysed yet 1 Oct 2026
CVE-2026-64947 CVE record

CVSS 7.5 High

CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager
- Pandora FMS
- Cross-site request forgery (CSRF)
- Unrestricted file upload
Not analysed yet 1 Oct 2026
CVE-2026-64946 CVE record

CVSS 7.4 High

CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager
- Pandora FMS
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
Not analysed yet 1 Oct 2026
CVE-2026-34190 CVE record

CVSS 5.9 Medium

CSRF in Alert Command Deletion
- Pandora FMS
- Cross-site request forgery (CSRF)
Not analysed yet 1 Oct 2026
CVE-2026-34189 CVE record

CVSS 5.9 Medium

CSRF in Event Response Deletion
- Pandora FMS
- Cross-site request forgery (CSRF)
Not analysed yet 1 Oct 2026
CVE-2026-101147 CVE record

CVSS 8.8 High

Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF
- Featured Image from URL (FIFU)
- Featured Image from URL (FIFU) Premium
- Cross-site request forgery (CSRF)
Not analysed yet 1 Oct 2026
CVE-2026-102399 CVE record

CVSS 5.4 Medium

WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability
- Photo Gallery by Supsystic
- Cross-site request forgery (CSRF)
Not analysed yet 30 Sept 2026
CVE-2026-97299 CVE record

CVSS 5.4 Medium

WordPress Razorpay Payment Links for WooCommerce plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- KnitPay Razorpay Payment Links for WooCommerce
- Cross-site request forgery (CSRF)
Not analysed yet 30 Sept 2026
CVE-2026-96838 CVE record

CVSS 8.8 High

WordPress Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- YoOhw Studio Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification
- Cross-site request forgery (CSRF)
Not analysed yet 30 Sept 2026
CVE-2026-95362 CVE record

CVSS 8.8 High

Cross-site request forgery in Google Chrome
- Google Chrome
- Cross-site request forgery (CSRF)
Not analysed yet 29 Sept 2026
CVE-2026-73597 CVE record

CVSS 6.5 Medium

Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager
- Dell Secure Connect Gateway (SCG) Policy Manager
- Cross-site request forgery (CSRF)
Not analysed yet 29 Sept 2026
CVE-2026-41875 CVE record

CVSS 6.9 Medium

Cross-Site Request Forgery in admin panel of Quick.Cart
- OpenSolution Quick.Cart
- Cross-site request forgery (CSRF)
Not analysed yet 29 Sept 2026
CVE-2026-67993 CVE record

CVSS 8.8 High

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback.
- Cross-site request forgery (CSRF)
Not analysed yet 29 Sept 2026
CVE-2026-101093 CVE record

CVSS 5.3 Medium

Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion
- Cotonti
- Cross-site request forgery (CSRF)
Not analysed yet 28 Sept 2026
CVE-2026-82380 CVE record

CVSS 8.1 High

Apache Roller: CSRF protection bypass via self-generated salt validation
- Apache Software Foundation Apache Roller
- Cross-site request forgery (CSRF)
Not analysed yet 28 Sept 2026
CVE-2026-100873 CVE record

CVSS 5.3 Medium

mathurvishal CloudClassroom-PHP-Project cross-site request forgery
- mathurvishal CloudClassroom-PHP-Project
- Cross-site request forgery (CSRF)
- Broken access control
Not analysed yet 27 Sept 2026
CVE-2026-100748 CVE record

CVSS 6.9 Medium

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0
- svenbluege.de Event Gallery for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2026
CVE-2026-100747 CVE record

CVSS 5.1 Medium

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0
- svenbluege.de Event Gallery for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2026
CVE-2026-100749 CVE record

CVSS 5.1 Medium

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0
- svenbluege.de Event Gallery for Joomla
- Cross-site request forgery (CSRF)
Not analysed yet 27 Sept 2026
CVE-2026-100712 CVE record

CVSS 7.1 High

froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF
- froxlor
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2026
CVE-2026-96524 CVE record

CVSS 8.8 High

MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF
- MCP Server for WordPress
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2026
CVE-2026-100524 CVE record

CVSS 5.3 Medium

Cotonti through 1.0.0 Cross-Site Request Forgery via Extensions Manager
- Cotonti
- Cross-site request forgery (CSRF)
Not analysed yet 26 Sept 2026