critical10.0
CVE-2026-61826
Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
morpheus65535 · bazarr
Your agent Now with CVE context
Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV
Find vulnerabilities that affect you.
Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Severity
56 matching advisories · 30 shown
Follow substantive record changes →SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium5.4
CVE-2026-119466
WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability
WPExperts · APIExperts Square for WooCommerce
high8.8
CVE-2026-65566
WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability
Meow Apps · AI Engine
medium6.5
medium5.1
CVE-2026-112374
FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
FOSSBilling · FOSSBilling
high7.7
CVE-2026-119426
phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
phpMyAdmin · phpMyAdmin
high7.1
CVE-2026-119407
Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters
element-hq · element-web / element-hq · element-desktop
high8.1
CVE-2026-61671
WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes
LabRedesCefetRJ · WeGIA
medium4.3
CVE-2026-27062
WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability
WPFunnels Team · WPFunnels
high8.8
CVE-2026-116399
WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability
InstaWP · InstaWP Connect
medium4.8
CVE-2026-5702
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application
SABBATIC · SABBATIC app
medium4.3
CVE-2026-110983
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
Unknown · WP Photo Album Plus
medium4.3
CVE-2026-115300
Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF
Unknown · Contact Form by Supsystic
medium5.4
CVE-2026-115299
Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF
Unknown · Contact Form by Supsystic
medium5.3
unknown
unknown
unknown
high8.8
CVE-2026-92797
Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter
MemberPress · Memberpress
high8.8
CVE-2026-111120
VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task
e4jvikwp · VikRentCar Car Rental Management System
medium6.5
CVE-2026-113486
Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
Unknown · Media Library Assistant
medium6.5
CVE-2026-113485
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
Unknown · Media Library Assistant
high8.8
CVE-2015-20129
CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/
CrushFTP · CrushFTP
critical9.6
CVE-2026-116863
WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability
Tribulant Software · Newsletters
high8.8
CVE-2026-117536
REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
redaxo · core
medium5.4
medium5.4
high7.1
CVE-2026-116880
Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions
SemanticMediaWiki · SemanticMediaWiki
medium5.3
CVE-2026-102787
Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5
phoca.cz · Phoca Download extension for Joomla
high7.1
CVE-2026-116839
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M…
Ubiquiti Inc · airMAX M