Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s...
CVE-2026-5923
Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage.
#cwe-352
共收录 794 条相关情报。
← 返回所有主题Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage.
CVE-2026-5923
Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage.
Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
CVE-2026-49471
### Summary Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port (TCP 2428
Waku: Cross-Origin CSRF on RSC Server Action Dispatch
CVE-2026-49455
## Summary Waku's RSC request dispatcher invokes server actions without validating the request's `Origin` (or `Sec-Fetc
Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
CVE-2026-53649
# Unauthenticated Cross-Origin Plugin Upload Leads to RCE (Joro ≤ v1.1.0) **Severity:** Critical **CVSS v3.1:** 9.6 (AV
A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-s...
CVE-2026-15034
A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some
flask-dashboard Flask-MonitoringDashboard cross-site request forgery
CVE-2026-15034
A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.11.1. Thi...
CVE-2026-12002
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Cross-Site Request
The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorrect nonce validati...
CVE-2026-9731
The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,
ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
### Summary In add-on mode, the ha-mcp settings UI routes are mounted both under the MCP secret path **and** at the bar
Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticate...
CVE-2026-49471
Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2,
Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
CVE-2026-49471
Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2,
Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged into Web Config, unintended operations may be performed.
CVE-2026-58315
Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicious page while logged
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a s...
CVE-2026-34171
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that...
CVE-2026-59713
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicio...
CVE-2026-59713
Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without
A weakness has been identified in imhamzaazam ecommerceFlask up to cb7d9e24c30a99379651b7493b32048126ef402b. The affected element is an unknown function. This manipulation cause...
CVE-2026-14800
A weakness has been identified in imhamzaazam ecommerceFlask up to cb7d9e24c30a99379651b7493b32048126ef402b. The affecte
Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site...
CVE-2026-59520
Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery. This i
Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery. This issue affects CrawlWP SEO: from n/a through 3.0.16.
CVE-2026-59520
Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery. This i
Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state...
CVE-2026-12740
Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 bu