Export limit exceeded: 10905 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10905 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75814 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 8.8 High |
| The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of device availability. | ||||
| CVE-2026-82468 | 1 Jeremyevans | 1 Rodauth | 2026-08-31 | 4.7 Medium |
| Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts. | ||||
| CVE-2026-17522 | 2026-08-30 | 5.4 Medium | ||
| The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack. | ||||
| CVE-2026-48549 | 1 Nagios | 3 Nagios Core, Nagios Xi, Xi | 2026-08-28 | 6.5 Medium |
| Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie protection can be bypassed by supplying matching NagFormId and nagFormId values in the POST body, allowing a cross-site request to execute Nagios commands as a currently authenticated user. | ||||
| CVE-2025-56798 | 2026-08-28 | 8.8 High | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy. | ||||
| CVE-2025-61480 | 2026-08-28 | 7.5 High | ||
| An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers. | ||||
| CVE-2026-78610 | 1 Watchguard | 1 Dimension | 2026-08-28 | N/A |
| WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent. | ||||
| CVE-2026-81733 | 1 Wwbn | 1 Avideo | 2026-08-28 | N/A |
| WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings (persisted in users.externalOptions), causing viewers to be redirected to a phishing site or shown a spoofed message. | ||||
| CVE-2026-80210 | 1 Frontaccounting | 1 Frontaccounting | 2026-08-27 | 6.5 Medium |
| FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the token, including gl/gl_journal.php, gl/gl_bank.php, purchasing/supplier_invoice.php, sales/customer_invoice.php, sales/customer_payments.php and admin/company_preferences.php, so those endpoints act on POST data with no origin check. An attacker who gets an authenticated user to load a page under attacker control can auto-submit a cross-origin form to any of them and have the forged journal entry, invoice, customer payment, bank transaction or company configuration change recorded under the victim's session. | ||||
| CVE-2026-81273 | 2026-08-27 | 8.1 High | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions. | ||||
| CVE-2026-81271 | 2 Paolo, Wordpress | 2 Geodirectory, Wordpress | 2026-08-27 | 8.8 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions. | ||||
| CVE-2026-76549 | 2 Updraftplus, Wordpress | 2 Updraftplus, Wordpress | 2026-08-27 | 5.9 Medium |
| The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link. | ||||
| CVE-2026-48548 | 1 Nagios | 1 Nagios Core | 2026-08-26 | 6.5 Medium |
| Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently authenticated user without their knowledge or consent. | ||||
| CVE-2026-56709 | 1 Getgrav | 1 Grav | 2026-08-26 | 7.5 High |
| Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows. | ||||
| CVE-2026-55526 | 1 Mervinpraison | 2 Praisonai, Praisonaiagents | 2026-08-25 | 8.5 High |
| PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, spider_tools._host_is_blocked() does not resolve ordinary hostnames before scrape_page fetches them. A hostname such as 127.0.0.1.nip.io passes validation and resolves to loopback, permitting internal HTTP access. The fix uses socket.getaddrinfo and fails closed on DNS errors. This issue is fixed in version 1.6.58. | ||||
| CVE-2026-55532 | 1 Mervinpraison | 1 Praisonai | 2026-08-25 | 7.6 High |
| PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream _validate_origin uses request_origin.startswith(allowed), allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests without preflight and invoke tools/call without an API key, including file writes that persist agent instructions. This issue is fixed in version 4.6.58. | ||||
| CVE-2026-78279 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Support | 2026-08-24 | 5.4 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions. | ||||
| CVE-2026-78280 | 2 Hashthemes, Wordpress | 2 Hash Form, Wordpress | 2026-08-24 | 4.3 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions. | ||||
| CVE-2026-68118 | 1 Linux | 1 Linux Kernel | 2026-08-23 | 8.2 High |
| In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RECEIVED The SYN-RECEIVED request-socket path in tcp_check_req() accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request instead of eliciting a challenge ACK. RFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in SYN-RECEIVED: an exact RST resets the connection, while a non-exact in-window RST must trigger a challenge ACK and be dropped. Apply that check before the ACK-field validation, following the RFC sequence-number, RST, then ACK processing order. Factor the per-netns challenge ACK quota out of tcp_send_challenge_ack() so request sockets can share it. Use the request socket's send_ack() callback and its own out-of-window ACK timestamp to send and rate-limit the response. | ||||
| CVE-2026-14853 | 2026-08-23 | N/A | ||
| The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to create draft bookable products. | ||||