共收录 791 条相关情报。
← 返回所有主题CVE-2026-84312
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor app
CVE-2026-54459
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0,
CVE-2022-51020
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the
CVE-2026-59977
ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanen
CVE-2026-108481
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request F
CVE-2026-108479
Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request F
CVE-2026-85960
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Que
CVE-2026-108909
A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of
CVE-2026-78358
Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authent
CVE-2026-48211
An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Requ
CVE-2026-84166
The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order ma
CVE-2026-108800
A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulat
CVE-2026-108738
Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into
CVE-2026-108738
Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into
CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote
CVE-2026-108553
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote
CVE-2026-107848
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN o
CVE-2026-107848
`RequestTokenListener` is the only generic `REQUEST_TOKEN` validator in Contao and it only runs on POST. On the GET side
CVE-2026-107809
## Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named `token` and the `AuthRequired` middleware accept
CVE-2026-107809
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-manage