Export limit exceeded: 10001 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 11117 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,117

Export CSV
CVE-2026-125838

WordPress Quality theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in webriti Quality quality allows Cross Site Request Forgery.This issue affects Quality: from n/a through 3.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125446

WordPress Edwiser Bridge plugin <= 4.3.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request Forgery.This issue affects Edwiser Bridge: from n/a through 4.3.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-105154

Apache Roller: Cross-site request forgery in Planet administration lets an attacker make the server fetch arbitrary URLs

Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a crafted web page. The action that adds a Planet subscription can be triggered cross-site; in recent releases it accepts GET requests, which Roller's CSRF token check does not cover. The action fetches the supplied URL and saves the subscription, and any fetched content that parses as a feed is then published without authentication in the aggregated Planet feed. The Planet aggregator is enabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST requests with a valid CSRF token for Planet administration changes and turns the Planet aggregator off by default.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Roller
CVE-2026-118411

Apache Roller: Cross-site request forgery through GET requests to administrative actions

Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an administrator account if a logged-in Roller administrator opens a link that the attacker controls. The request-token check applied only to POST requests, and administrative actions also accepted GET requests. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST and a valid token for actions that change data.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Roller
CVE-2026-124194

Microsoft Outlook Spoofing Vulnerability

Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Listed
Vendors
Microsoft
Products
365 Apps Office 2021 Office 2024
CVE-2026-15046

LitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRF

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Store To Woocommerce Migration
CVE-2026-32148

Lockfile checksums not verified in Hex allows dependency integrity bypass

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums. Hex stores checksums for dependencies in the mix.lock file to ensure reproducible and integrity-checked builds. However, Hex.RemoteConverger.verify_resolved/2 never executes checksum verification because the lock data returned by Hex.Utils.lock/1 uses string-based dependency names, while the verification logic compares against atom-based names. This type mismatch causes the verification code path to be silently skipped. Checksums are still validated when packages are initially downloaded from the registry, but mismatches between the lockfile and resolved dependencies are not detected. An attacker who can influence cached packages (e.g., via local cache poisoning or a compromised registry) can provide modified dependency contents that will be accepted without detection. The mix.lock file is silently rewritten with the checksum values from the registry, erasing evidence of tampering. This issue affects hex: from 0.16.0 before 2.4.2.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Hex Hexpm
Products
Hex Hex
CVE-2026-126775

Social-auth-core 4.7.0 before 7.0.0 Login CSRF via SAML RelayState

Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-118152

Microsoft Exchange Server Spoofing Vulnerability

Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Exchange Server Se
CVE-2026-96760

Authlib library contains a signature‑verification bypass vulnerability

Authlib (v1.8.0 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Authlib
Products
Authlib
CVE-2026-17522

Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, including the credential protecting its API, via a Cross-Site Request Forgery attack.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Newsletters
CVE-2026-81426

WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wc Vendors
CVE-2026-81432

JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Jetstylemanager
CVE-2026-14941

Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions

The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal permissions such as Subscribers to invoke administrative settings handlers, update Customer Reviews for WooCommerce WordPress plugin before 5.116.0 options, and disclose store configuration.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Customer Reviews For Woocommerce
CVE-2026-11981

GiveWP <= 4.15.3 - Cross-Site Request Forgery

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.15.3 This is due to missing nonce validation on the give_set_notification_status_handler() function. This makes it possible for unauthenticated attackers to disable donation email notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Stellarwp Wordpress-extensions
Products
Givewp Givewp
CVE-2026-85632

Unauthenticated Payment Status Manipulation in Sipay Electronic Money's WordPress (WooCommerce)

Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module allows Authentication Bypass and Application API Message Manipulation via Man-in-the-Middle. This issue affects WooCommerce Virtual POS Module: from 26.8.3 before 26.9.1.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-89119

Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager

SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-13729

Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Podlove Podcast Publisher