Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,119

Export CSV
CVE-2026-122144

nliautaud pico-content-editor cross-site request forgery

A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af. This vulnerability affects unknown code. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nliautaud
Products
Pico-content-editor
CVE-2025-71454

vtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering

vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read from $_REQUEST, performing actions as that user.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vtenext
Products
Vtenext
CVE-2026-118633

Path‑Traversal Remote Code Execution Risk in Sophos SG UTM Email Proxy

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Sophos
Products
Sg Utm
CVE-2026-50628

Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Build Of Apache Camel Fuse and 1 more
CVE-2026-120206

Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia Thelia Back-office Default Template Thelia Back-office Default Twig Template and 1 more
CVE-2026-101495

Siebel CRM Development Cross‑Site Request Forgery Leading to Full Takeover via Siebel Approval Manager

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Siebel Crm Siebel Crm Development
CVE-2024-3727

Containers/image: digest type does not guarantee valid type

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

CVSS 3.1 · 8.3 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Acm Advanced Cluster Security Ansible Automation Platform and 16 more
CVE-2024-12088

Rsync: --safe-links option bypass leads to path traversal

A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.

CVSS 3.1 · 6.5 Medium EPSS 4.6% KEV · Not listed
Vendors
Almalinux Archlinux Gentoo and 5 more
Products
Almalinux Arch Linux Linux and 19 more
CVE-2023-5455

Ipa: invalid csrf protection

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Freeipa Redhat
Products
Fedora Freeipa Codeready Linux Builder and 23 more
CVE-2026-61826

Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery

Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin/<pin_id>/check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Morpheus65535
Products
Bazarr
CVE-2009-4139

Spacewalk-java: spacewalk: red hat network satellite: spacewalk java: privilege escalation via cross-site request forgery

A flaw was found in Spacewalk Java site packages. This cross-site request forgery (CSRF) vulnerability allows a remote attacker to hijack the authentication of arbitrary users. This can lead to unauthorized actions, including disabling user accounts, adding new user accounts, or escalating privileges by modifying existing user accounts to have administrator access.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Network Satellite Network Satellite Server Rhel Els and 1 more
CVE-2026-117534

REDAXO before 5.21.3 CSRF in Article History Plugin

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redaxo
Products
Core Redaxo
CVE-2026-116895

REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redaxo
Products
Core Redaxo
CVE-2026-118776

Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKCS#7 padding during CBC and ECB decryption and accepted zero, oversized, or mismatched padding bytes. Malformed ciphertext could consequently be accepted and up to four plaintext blocks could be silently removed, causing an integrity failure in applications that treated successful decryption as proof of valid padding. This issue is fixed in version 1.4.1.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Digitalbazaar
Products
Forge
CVE-2026-91393

Unauthorized Data Modification via CSRF in Oracle Siebel CRM End User

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Oracle
Products
Siebel Crm Siebel Crm End User
CVE-2026-102787

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Phoca
Products
Phoca Download Extension For Joomla
CVE-2026-45109

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed in 15.5.18 and 16.2.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Vercel
Products
Next.js
CVE-2026-62374

SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed `_sd` array and returns a reduced claim set, reporting success while the Issuer signature remains valid. Both a tampered Disclosure that remains valid JSON and a Disclosure containing invalid UTF-8 bytes reach this silent-drop behavior. In the latter case, the `TextDecoder / Buffer` decoding path substitutes U+FFFD replacement characters, recovering syntactically valid disclosure data instead of rejecting the malformed input. This violates RFC 9901 section 7.1 step 5, which requires rejection of unreferenced Disclosures, and section 7.1 step 3 / section 4.2.1, which require rejection of invalid Disclosures. A malicious holder can exploit this omission primitive, including through `SDJwtInstance.verify()` when key binding is required. An on-path attacker can also tamper with a Disclosure when the relying party does not enforce key binding; enforced key binding rejects on-path tampering because it invalidates the KB-JWT `sd_hash` binding. If the relying party defaults to allowing access when a constraining age, role, or restriction claim is absent, the silent claim reduction can change an authorization decision without an error. This issue is fixed in `@sd-jwt/core` version 0.20.0; no patched version of the standalone `@sd-jwt/decode` package is identified.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Openwallet-foundation
Products
Sd-jwt/core Sd-jwt/decode
CVE-2026-119407

Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Element Element-hq
Products
Element Element-web
CVE-2025-68584

WordPress Vimeotheque plugin <= 2.3.5.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress