CVE-2026-9215 is a cross-site request forgery (CSRF) vulnerability affecting NETGEAR XR1000v2 routers. An attacker can exploit this vulnerability by tricking a router administrator into performing unintended actions, potentially altering router configurations and disrupting operations. There is no impact on confidentiality. The vulnerability has a low severity score and no known exploits in the wild. No official patch or remediation information is provided.
A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page.
CVE-2026-33920 is a medium severity cross-site request forgery (CSRF) vulnerability in Nozomi Networks Guardian affecting versions before 26.3.0. It occurs in the login functionality (standard and SAML) due to missing anti-CSRF token validation. An attacker with a valid account can trick a victim into authenticating with the attacker's credentials, causing victim actions to be attributed to the attacker and compromising audit trail integrity.
CVE-2026-76961 is a Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA Finance for Advanced Payment Management. The product does not sufficiently protect certain requests against CSRF attacks. An attacker with low privileges could craft a malicious link or page that, if visited by an authenticated user, could trigger unintended actions on the server. The impact is limited to a low confidentiality and integrity impact, with no availability impact.
CVE-2026-76960 is a Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA Finance for Advanced Payment Management. The product does not sufficiently protect certain requests against CSRF attacks, allowing an attacker with low privileges to craft malicious links or pages. If an authenticated user interacts with these, unintended actions could be executed on their behalf. The impact is limited to low confidentiality and integrity effects, with no availability impact. The vulnerability affects versions 106 and 107 of the product. The CVSS score is 3.5, indicating low severity.
CVE-2026-76959 is a Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA Finance for Advanced Payment Management. The product does not sufficiently protect certain requests against CSRF attacks, allowing an attacker with low privileges to craft malicious links or pages. If an authenticated user interacts with these, unintended actions may be executed on their behalf. The impact is limited to confidentiality and integrity with no availability impact. The CVSS score is 4.6, indicating medium severity. Affected versions are SAP S/4HANA Finance Advanced Payment Management versions 900, 901, and 902. There is no information about available patches or vendor advisories. No known exploits in the wild have been reported.
CVE-2026-86307 is a cross-site request forgery (CSRF) vulnerability affecting the light0011 cms. The vulnerability allows remote attackers to perform unauthorized actions by tricking authenticated users into submitting forged requests. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available. The CVSS 4.0 base score is 5.3, indicating a medium severity risk.
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.
Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device.
Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.
Waku is the minimal React framework. Prior to version 1.0.0-beta.1, Waku's RSC request dispatcher invokes server actions without validating the request's Origin (or Sec-Fetch-Site) header. A cross-origin web attacker can therefore cause a victim browser to issue an authenticated POST to a registered server action endpoint using a CORS-safelisted content type (text/plain), which does not trigger a preflight. Any state-mutating server action that the application exposes via 'use server' can be invoked with the victim's cookies attached. This issue has been patched in version 1.0.0-beta.1.
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reach privileged endpoints - including uploading a native plugin and triggering a restart - directly through the operator's browser, with no preflight or credentials. Since plugins execute on load, this yields unauthenticated remote code execution as the operator's user from a single page visit. This issue has been patched in version 1.1.1.
The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers to trick a logged-in administrator into changing the configured third-party API key. Once replaced, all subsequent member registration data (name, email, membership level) is sent to the attacker-controlled account.
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery.
This issue affects Grand Tour: from n/a through 5.5.1.
The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.