Export limit exceeded: 10681 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10681 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84649 | 1 Jenkins Project | 1 Jenkins | 2026-09-03 | 8.8 High |
| In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 through 2.579 (both inclusive), LTS 2.452.1 through 2.568.2 (both inclusive), an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's cross-site request forgery (CSRF) token (crumb) as a string literal, allowing attackers with control over a page hosted on the same site as Jenkins to obtain a valid crumb for the targeted user's session and perform actions on their behalf. | ||||
| CVE-2026-20354 | 1 Cisco | 1 Secure Email | 2026-09-03 | 5.9 Medium |
| Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication. | ||||
| CVE-2026-85161 | 1 Wwbn | 1 Avideo | 2026-09-03 | 4.3 Medium |
| AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbnail files via GET requests. | ||||
| CVE-2026-7326 | 2 Progress, Progress Software Corporation | 2 Marklogic Server, Marklogic Server | 2026-09-03 | 7.5 High |
| A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthorized changes to security configuration. | ||||
| CVE-2026-84759 | 2 Elementor, Wordpress | 2 Activity Log, Wordpress | 2026-09-03 | 7.1 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in Activity Log <= 2.13.1 versions. | ||||
| CVE-2026-73718 | 2 Arubanetworks, Hewlett Packard Enterprise (hpe) | 2 Fabric Composer, Fabric Composer | 2026-09-03 | 7.4 High |
| A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer. | ||||
| CVE-2026-85162 | 1 Wwbn | 1 Avideo | 2026-09-03 | 6.5 Medium |
| AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTMP keys, passwords, and titles, hijacking live broadcasts. | ||||
| CVE-2026-84663 | 1 Jenkins Project | 1 Jenkins Pipeline Groovy Libraries Plugin | 2026-09-03 | 5.4 Medium |
| A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attackers to delete shared library caches. | ||||
| CVE-2026-18780 | 1 Tmt Machine | 1 Talassoft Industrial Management Software | 2026-09-02 | 7.1 High |
| Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16. | ||||
| CVE-2026-84770 | 2 Kitae-park, Wordpress | 2 Mang Board Wp, Wordpress | 2026-09-02 | 8.8 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions. | ||||
| CVE-2026-66652 | 2 Themegoods, Wordpress | 2 Grand Tour, Wordpress | 2026-09-02 | 5.4 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1. | ||||
| CVE-2026-8151 | 2026-09-02 | 5.4 Medium | ||
| The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account. | ||||
| CVE-2026-12816 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 4 Bc-java, Bouncy Castle For Java Lts, Bc-java and 1 more | 2026-09-02 | 7.5 High |
| In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12. | ||||
| CVE-2026-12803 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 4 Bc-java, Bouncy Castle For Java Lts, Bc-java and 1 more | 2026-09-02 | 7.5 High |
| In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12. | ||||
| CVE-2026-12802 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 6 Bc-java, Bcpkix-fips, Bouncy Castle For Java Lts and 3 more | 2026-09-02 | 7.5 High |
| In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). | ||||
| CVE-2026-58061 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 6 Bc-java, Bouncy Castle For Java Lts, Fips Java Api and 3 more | 2026-09-02 | 7.5 High |
| In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before tag check. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | ||||
| CVE-2026-72658 | 1 Elastic | 1 Kibana | 2026-09-02 | 7.3 High |
| Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session. | ||||
| CVE-2026-29113 | 1 Craftcms | 2 Craft Cms, Craftcms | 2026-09-02 | 4.3 Medium |
| Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker. That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope. This vulnerability is fixed in 4.17.3 and 5.9.7. | ||||
| CVE-2026-19650 | 1 Gitlab | 1 Gitlab | 2026-09-02 | 7.1 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling. | ||||
| CVE-2026-81432 | 2026-09-02 | 4.3 Medium | ||
| The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link. | ||||