CVE-2026-82911

CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes

Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Roskus

Products

Prospero Flow Crm

CVE-2026-85547

Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept header. Because Accept: application/json can be supplied by a cross-origin page without requiring a CORS preflight, an attacker could cause a request originating from another website to be treated as REST traffic. MISP would consequently disable its normal form-security and CSRF validation even though the request was authenticated using the victim's existing browser session. An unauthenticated remote attacker could exploit this behavior by convincing an authenticated MISP user to visit or interact with a malicious web page. The attacker's page could then issue crafted requests to susceptible state-changing MISP endpoints using the victim's privileges. Depending on the permissions of the victim and the targeted endpoint, this could allow unauthorized modification, creation, publication, or removal of data and other state changes. The vulnerability originates from granting the form-security exemption based on _isRest() rather than on the authentication mechanism used by the request. The patch changes this behavior so that CSRF and form-security exemptions are granted only when the request actually carries a MISP API key. Session-authenticated REST-style requests remain subject to CSRF protection. The fix also introduces support for transmitting CSRF tokens through the X-CSRF-Token header for legitimate same-origin AJAX requests. Such a header cannot normally be attached by a cross-origin page without triggering a CORS preflight, preventing it from being used to reproduce the original attack.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Misp

Products

Misp

CVE-2026-49455

Waku: Cross-Origin CSRF on RSC Server Action Dispatch

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via 'use server' can be invoked with the victim's cookies attached. This issue has been patched in version 1.0.0-beta.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wakujs

Products

Waku

CVE-2026-73780

Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX

A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF) protection. This could allow a remote unauthenticated attacker to execute arbitrary input against the affected interface if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Hewlett Packard Enterprise (hpe) Hpe

Products

Aos-cx Aruba Cx 10000-48y6c \(r8p13a\) Aruba Cx 10000-48y6c \(r8p14a\) and 154 more

CVE-2026-18165

@fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the browser that began the flow. Any party able to write a cookie for the application's host, such as a sibling subdomain under the same registrable domain, can plant matching state and verifier cookies and complete an attacker-owned OAuth flow inside a victim's browser, silently signing the victim in to the attacker's account (login CSRF). It does not expose the victim's own account, credentials, or tokens. The issue is fixed in @fastify/oauth2 8.3.0, which adds an opt-in hostPrefixedCookies option. Users should upgrade to 8.3.0 and enable it, or bind state to a server-side session.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Fastify

Products

Fastify\/oauth2 Oauth2

CVE-2026-84764

WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Nsquared Wordpress

Products

Simply Schedule Appointments Wordpress

CVE-2026-53649

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Bishopfox

Products

Joro

CVE-2026-61082

Multiple Weaknesses in Oracle MySQL Connector/J Allow Unauthorized Data Access

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Oracle

Products

Mysql Connector/j Mysql Connector\/j Mysql Connectors

CVE-2026-85161

AVideo removePoster.php Cross-Site Request Forgery File Deletion

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-7326

Cross-site request forgery in Progress MarkLogic Server Admin UI

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthorized changes to security configuration.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software Corporation

Products

Marklogic Server Marklogic Server

CVE-2026-84759

WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Elementor Wordpress

Products

Activity Log Wordpress

CVE-2026-73718

Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Fabric Composer Fabric Composer

CVE-2026-85162

AVideo through c91b5975d CSRF via saveLive.php

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-84663

CSRF Vulnerability Allowing Deletion of Shared Library Caches in Jenkins Pipeline Groovy Libraries Plugin

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Project

Products

Jenkins Pipeline Groovy Libraries Plugin

CVE-2026-18780

CSRF in TMT Machine's Talassoft Industrial Management Software

Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tmt Machine

Products

Talassoft Industrial Management Software

CVE-2026-84770

WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Kitae-park Wordpress

Products

Mang Board Wp Wordpress

CVE-2026-66652

WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Themegoods Wordpress

Products

Grand Tour Wordpress

CVE-2026-8151

Simple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRF

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-72658

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Kibana

CVE-2026-29113

Craft has a potential information disclosure vulnerability in preview tokens

Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker. That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope. This vulnerability is fixed in 4.17.3 and 5.9.7.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Craftcms

Products

Craft Cms Craftcms