CVE-2026-91819

MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP’s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as: _method=GET the body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body Version affected: ≤2.5.45

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Misp

Products

Misp

CVE-2026-88871

WWBN AVideo CustomizeUser setSubscribers CSRF via GET

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without requiring a POST request or a valid CSRF token; autoCSRFGuard() is applied only to POST requests to *.json.php, and the mutation does not pass through ObjectYPT::save()/isUntrustedRequest(), so a cross-origin GET succeeds. An unauthenticated remote attacker who induces a logged-in administrator to load a crafted page (for example an <img> tag pointing at the endpoint) can forge the ExtraSubscribers count displayed on any user's channel. The CustomizeUser plugin is enabled by default, and no patched version was available at the time of reporting.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-82764

Cross‑Site Request Forgery in Contec Device Web Interfaces

Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-91857

MISP: State-changing actions accessible via GET request enabling CSRF

Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are:  - EventReportsController::purgeUnusedPictures()  - NoticelistsController::enableNoticelist()  - ServersController::removeOrphanedCorrelations()  - WorkflowsController::rebuildRedis() The patch adds allowMethod(['post']) to each action, preventing them from being triggered through ordinary GET requests. For purgeUnusedPictures(), the corresponding UI previously used $.get(). The fix converts that request to POST and supplies X-CSRF-Token, while the controller enables header-only CSRF validation for that AJAX action. Because GET requests can be induced cross-origin through links, images, redirects, or navigation, accepting GET for these state-changing operations can let an attacker trigger them using the authenticated victim's session. Version affected: ≤2.5.45

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Misp

Products

Misp

CVE-2026-52823

Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/{id}/stop and GET /api/timesheets/{id}/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense. A remote attacker can cause a logged-in user to request either route from attacker-controlled content, stopping a running timesheet or restarting a historical entry to create and start a new timesheet without the user's consent. The unauthorized changes can corrupt time records, billing, reports, approvals, and audits. This issue is fixed in version 2.58.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kimai

Products

Kimai

CVE-2025-12821

NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Installation

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.5.9. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This is due to a reverted fix of CVE-2025-1305.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Spicethemes Wordpress

Products

Newsblogger Wordpress

CVE-2026-17047

IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery []

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to improper request validation.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Db2 Mirror For I

CVE-2026-50025

Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse (MAM) session cookie in state and reuses the same cookie-bearing serialization for persisted state, public API responses, and WebSocket state updates. Any client that can reach the published Mousehole port can read cookie-bearing state, connect to WebSocket state updates, replace the stored cookie, or force MAM update side effects. The deployment examples publish port 5010 broadly with Docker's `5010:5010` syntax, which can make the issue reachable on mixed-trust LAN/VPN interfaces. Version 0.4.0 patches the issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

T-mart

Products

Mousehole

CVE-2026-49992

Kimai: Login CSRF in Default Team Creation Endpoints Allows Unauthorized Team and Permission Structure Changes

Kimai is an open-source time tracking application. Versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through `GET` routes and directly create or reuse a `Team`, add the current user as teamlead, and bind the target object to that team. As a result, an attacker can trick a logged-in user with the required permissions into visiting a malicious page and cause unauthorized changes to team, teamlead, and object-binding relationships. This is a real authorization-structure modification issue rather than a harmless UI shortcut. Version 2.58.0 patches the issue.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kimai

Products

Kimai

CVE-2026-90599

Rizwan17 inventory-management-system process.php cross-site request forgery

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rizwan17

Products

Inventory-management-system

CVE-2026-90893

MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim's settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim's default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user's visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team. Version affected: ≤2.5.45

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Misp

Products

Misp

CVE-2026-78084

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property < 4.1.4 - The gallery management controller tasks lacked authorization checks and CSRF token validation.. Users could invoke file removal actions with arbitrary path strings or upload unverified file types.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joomshaper.com

Products

Sp Property Extension For Joomla

CVE-2026-78083

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property < 4.1.4 - The visitor booking (properties.booking) and agent contact form submission (agents.sendmail) endpoints processed POST requests without verifying Joomla session anti-CSRF tokens.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Joomshaper.com

Products

Sp Property Extension For Joomla

CVE-2026-62133

WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Rometheme Wordpress

Products

Rtmkit Wordpress

CVE-2026-62139

WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Wordpress

Products

Site Kit By Google Wordpress

CVE-2026-9215

A CSRF vulnerability exists in certain NETGEAR XR series devices

A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models allows an attacker who can leverage social engineering techniques on a router administrator to tamper with router configuration and disrupt router operations with active assistance from the router administrator. There is no confidentiality impact due to this vulnerability.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Xr1000 Xr1000 Firmware Xr1000v2 and 3 more

CVE-2026-86281

SourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Syllabus-aligned Learning Management Examination System

CVE-2026-82468

Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jeremyevans

Products

Rodauth

CVE-2026-89245

WWBN AVideo Cross-Site Request Forgery via playlistRemove.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to playlistRemove.php, causing a victim's playlist to be deleted when they visit the attacker's page while logged in.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-38057

ST Engineering iDirect iQ-Series Terminals Cross-Site request forgery

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss. Repeated attacks can sustain a denial-of-service condition.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

St Engineering Idirect

Products

3315-series 9-series Terminals Evolution Iq‑series Terminals