Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery.
This issue affects Talassoft Industrial Management Software: from V.4 before V.16.
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account. This issue has been patched in version 4.9.4.
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken() is not called for this state-changing operation. In the shipped php/connector.minimal.php-dist configuration, FTP network mounts are enabled by default, and attacker-controlled protocol, host, path, port, user, pass, alias, and options arguments flow through elFinder::netmount() in php/elFinder.class.php to php/elFinderVolumeFTP.class.php. A cross-site request can therefore persist an attacker-chosen FTP mount in the victim's session, cause the PHP server to connect to an attacker-chosen FTP host and port, and send supplied credentials without an X-elFinder-CSRF token. This issue is fixed in version 2.1.70.
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.
CVE-2026-71378 is a Cross-Site Request Forgery (CSRF) vulnerability in Apache Wicket's ResourceIsolationRequestCycleListener, affecting versions 9.1.0 through 9.23.0 and 10.0.0 through 10.10.0. The default resource isolation policy allows unsafe cross-origin and same-site requests that can be exploited to invoke component listeners within an authenticated session. This can enable an attacker controlling a page or a sibling origin to perform actions on behalf of a user. Versions prior to 9.1.0 are not affected as the vulnerable classes do not exist. The issue is fixed in versions 9.24.0 and 10.11.0.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Newsletters WordPress plugin before version 4.17. The plugin does not perform nonce or capability checks when saving certain settings, allowing an attacker to trick a logged-in administrator into changing plugin settings, including API credentials, via a CSRF attack.
CVE-2026-78610 is a high-severity vulnerability in WatchGuard Dimension version 2.0 where the web UI's administrator passphrase change function lacks Cross-Site Request Forgery (CSRF) protection. This allows an attacker to trick an authenticated global administrator into changing their passphrase to a value chosen by the attacker without the administrator's consent.
CVE-2026-75814 is a high-severity Cross-Site Request Forgery (CWE-352) vulnerability in the Ebyte NA111-M firmware version 9013-2-17. The device's web management interface fails to properly verify the origin or authenticity of requests, allowing an unauthenticated remote attacker to trick an authenticated administrator into performing unauthorized actions. This can lead to unauthorized configuration changes or disruption of device availability.
CVE-2026-81273 is a high severity Cross-Site Request Forgery (CSRF) vulnerability affecting WP Manage Ninja's FluentBooking Pro plugin versions up to and including 2.2.4. The vulnerability allows unauthenticated attackers to perform actions on behalf of legitimate users by tricking them into submitting unwanted requests. No official patch or remediation information is currently available.
CVE-2026-81271 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting GeoDirectory versions up to 2.8.176. It allows unauthenticated attackers to perform unauthorized actions by tricking users into submitting unwanted requests. The vulnerability has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor advisories for updates and apply fixes once released.
CVE-2026-76549 is a Cross-Site Request Forgery (CSRF) vulnerability in the UpdraftPlus: WP Backup & Migration Plugin for WordPress. Versions before 1.26.7 lack CSRF protections in a backup management action, allowing an attacker to trick a logged-in admin into restoring a backup via a crafted link. This could revert the site's database and files to an earlier state without the admin's explicit consent.
CVE-2026-55532 is an origin validation vulnerability in MervinPraison PraisonAI prior to version 4.6.58. The issue arises because the HTTP stream origin validation uses a startswith check, allowing attacker-controlled origins like localhost.attacker.com to bypass the localhost allowlist. This enables a webpage to send text/plain requests without preflight and invoke certain API calls without an API key, including file writes that can persist agent instructions. The vulnerability is fixed in version 4.6.58.
CVE-2026-78280 is a Cross-Site Request Forgery (CSRF) vulnerability affecting HashThemes Hash Form versions up to and including 1.4.0. This vulnerability allows an unauthenticated attacker to trick a user into submitting unwanted requests to the application. The issue has a medium severity rating with a CVSS score of 4.3.
CVE-2026-78279 is a Cross-Site Request Forgery (CSRF) vulnerability affecting WP ManageNinja LLC's Fluent Support Pro plugin versions up to and including 2.3.1. This vulnerability allows an unauthenticated attacker to trick a user into performing unwanted actions via a crafted request. The vulnerability has a medium severity rating with a CVSS score of 5.4.
Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.
Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.65. The issue is due to missing CSRF tokens on front-end state-changing actions, allowing an attacker with high privileges to potentially trick a user into performing unintended actions. The vulnerability has a medium severity score of 4.6.
CVE-2026-15046 is a Cross-Site Request Forgery (CSRF) vulnerability in the LitExtension WordPress plugin versions up to 1.2.5. The plugin does not verify a nonce before performing an administrative action that overwrites the store-migration connector's authentication token. This flaw allows an attacker to trick a logged-in administrator into clicking a crafted link, resulting in takeover of the connector token.
CVE-2026-66001 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in the Frappe web application framework affecting versions prior to 15.114.0 and between 16.0.0-beta.1 and 16.26.0. The flaw allows the OAuth2 consent flow to be exploited because the approve and authorize functions do not restrict approval to POST requests, lack CSRF tokens in the OAuth confirmation template, and fail to scope active OAuth token checks to the requesting client. This can enable an attacker to cause an authenticated user to approve OAuth grants improperly or reuse authorization states for incorrect clients, potentially exposing data and permitting unauthorized actions within granted scopes. The issue is fixed in versions 15.114.0 and 16.26.0.
CVE-2026-63654 is a Cross-Site Request Forgery (CSRF) vulnerability in the Frappe web application framework version 16.31.0 and earlier. The vulnerability arises because the endpoint frappe.model.workflow.bulk_workflow_approval accepts safe HTTP methods for state-changing workflow approvals and is not restricted to POST requests. This allows an attacker to trick an authenticated user into submitting an approval action with the user's privileges. No fixed version has been released as of the latest review.