52 CVEs — updated 2026-11-02 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-61826 | Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/a | CRITICAL | 10.0 | 18%ile | NVD | 2026-10-30 |
| CVE-2026-116863 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Req | CRITICAL | 9.6 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-63190 | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, f | CRITICAL | 9.4 | 46%ile | NVD | 2026-10-28 |
| CVE-2026-116838 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) | HIGH | 8.8 | 32%ile | NVD | 2026-10-27 |
| CVE-2026-111120 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers | HIGH | 8.8 | 24%ile | NVD | 2026-10-28 |
| CVE-2026-92797 | The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14. | HIGH | 8.8 | 4%ile | NVD | 2026-10-28 |
| CVE-2026-116399 | Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request For | HIGH | 8.8 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-65566 | Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This | HIGH | 8.8 | 6%ile | NVD | 2026-10-30 |
| CVE-2026-116748 | Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that expos | HIGH | 8.7 | 69%ile | NVD | 2026-10-26 |
| CVE-2026-102800 | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article | HIGH | 8.7 | 33%ile | NVD | 2026-10-27 |
| CVE-2026-117536 | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/ | HIGH | 8.6 | 3%ile | NVD | 2026-10-27 |
| CVE-2015-20129 | CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrativ | HIGH | 8.6 | 4%ile | NVD | 2026-10-28 |
| CVE-2026-85749 | MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, in | HIGH | 8.1 | 21%ile | NVD | 2026-10-28 |
| CVE-2026-61671 | WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle | HIGH | 8.1 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-119426 | phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arb | HIGH | 7.7 | 21%ile | NVD | 2026-10-30 |
| CVE-2026-59978 | AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?scrip | HIGH | 7.5 | 51%ile | NVD | 2026-10-30 |
| CVE-2026-120205 | Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows u | HIGH | 7.4 | 18%ile | NVD | 2026-10-31 |
| CVE-2026-103420 | Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5 | HIGH | 7.2 | — | NVD | 2026-11-02 |
| CVE-2026-116839 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) | HIGH | 7.1 | 1%ile | NVD | 2026-10-27 |
| CVE-2026-116880 | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin becau | HIGH | 7.1 | 1%ile | NVD | 2026-10-27 |
| CVE-2026-119407 | Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, all | HIGH | 7.1 | 4%ile | NVD | 2026-10-30 |
| CVE-2026-120207 | Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to dele | HIGH | 7.0 | 10%ile | NVD | 2026-10-31 |
| CVE-2026-116873 | Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that | MEDIUM | 6.9 | 9%ile | NVD | 2026-10-27 |
| CVE-2026-116890 | Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module | MEDIUM | 6.9 | 9%ile | NVD | 2026-10-27 |
| CVE-2026-120249 | Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/ | MEDIUM | 6.9 | 4%ile | NVD | 2026-11-01 |
| CVE-2026-113485 | The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Libr | MEDIUM | 6.5 | 3%ile | NVD | 2026-10-28 |
| CVE-2026-113486 | The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, s | MEDIUM | 6.5 | 3%ile | NVD | 2026-10-28 |
| CVE-2026-45141 | Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the `add`, `delete_gradebook_from_skill`, `sav | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-30 |
| CVE-2026-116893 | REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets n | MEDIUM | 6.1 | 17%ile | NVD | 2026-10-27 |
| CVE-2026-120206 | Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forg | MEDIUM | 5.9 | 4%ile | NVD | 2026-10-31 |
| CVE-2026-115299 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settin | MEDIUM | 5.4 | 0%ile | NVD | 2026-10-29 |
| CVE-2026-119466 | Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross Si | MEDIUM | 5.4 | 2%ile | NVD | 2026-10-30 |
| CVE-2026-102787 | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | MEDIUM | 5.3 | 6%ile | NVD | 2026-10-27 |
| CVE-2026-116874 | SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenti | MEDIUM | 5.3 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-116875 | SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which | MEDIUM | 5.3 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-118266 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as th | MEDIUM | 5.3 | 6%ile | NVD | 2026-10-28 |
| CVE-2026-107262 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This is | MEDIUM | 5.3 | 2%ile | NVD | 2026-10-30 |
| CVE-2026-116895 | REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET | MEDIUM | 5.1 | 1%ile | NVD | 2026-10-27 |
| CVE-2026-117534 | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows att | MEDIUM | 5.1 | 1%ile | NVD | 2026-10-27 |
| CVE-2026-117535 | REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, wher | MEDIUM | 5.1 | 10%ile | NVD | 2026-10-27 |
| CVE-2026-112374 | FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /ap | MEDIUM | 5.1 | 7%ile | NVD | 2026-10-30 |
| CVE-2026-5702 | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticat | MEDIUM | 4.8 | 7%ile | NVD | 2026-10-29 |
| CVE-2026-110983 | The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its | MEDIUM | 4.3 | 1%ile | NVD | 2026-10-29 |
| CVE-2026-115300 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two ad | MEDIUM | 4.3 | 1%ile | NVD | 2026-10-29 |
| CVE-2026-27062 | Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery. | MEDIUM | 4.3 | 1%ile | NVD | 2026-10-29 |
| CVE-2026-117537 | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inje | LOW | 2.1 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-117538 | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the func | LOW | 2.1 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-82898 | Incorrect order of security checks in Apache Wicket. org.apache.wicket.protocol.http.ResourceIsolationRequestCycleListe | LOW | 2.1 | — | NVD | 2026-11-01 |
| CVE-2026-114541 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue | UNKNOWN | — | 1%ile | NVD | 2026-10-30 |
| CVE-2026-118543 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue af | UNKNOWN | — | 2%ile | NVD | 2026-10-30 |
| CVE-2026-118558 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue | UNKNOWN | — | 1%ile | NVD | 2026-10-30 |
| CVE-2026-118570 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affec | UNKNOWN | — | 1%ile | NVD | 2026-10-30 |