СИТУАЦИОННЫЙ ОБЗОР
Все уязвимости
Поиск по CVE, продуктам и источникам. Условия фильтра сохраняются в ссылке.
Лента уязвимостей
30| УЯЗВИМОСТЬ / ПРОДУКТ | ПРИОРИТЕТ | CVSS | EPSS | СИГНАЛЫ | ОПУБЛИКОВАНА | Карточка |
|---|---|---|---|---|---|---|
| CVE-2026-115796 Tenda F6 Web Management cross-site request forgery Tenda / F6 | Высокий | 5.3 | 0,16 % | PoC | 23.10.2026 | |
| CVE-2026-91246 Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component:... Oracle Corporation / Oracle WebCenter Portal | Средний | 6.1 | 0,25 % | 21.10.2026 | ||
| CVE-2026-86467 Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account Apache Software Foundation / Apache Airflow Amazon provider | Высокий | 8.8 | 0,17 % | Патч | 20.10.2026 | |
| CVE-2026-116399 WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability InstaWP / InstaWP Connect | Высокий | 8.8 | — | 29.10.2026 | ||
| CVE-2026-107618 Gitea cross-site request forgery on repository topics Gitea / Gitea | Высокий | 8.1 | 0,16 % | Патч | 18.10.2026 | |
| CVE-2026-116052 LinkStackOrg LinkStack cross-site request forgery LinkStackOrg / LinkStack | Средний | 5.3 | 0,21 % | 25.10.2026 | ||
| CVE-2026-5702 Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application SABBATIC / SABBATIC app | Средний | 4.8 | — | 29.10.2026 | ||
| CVE-2026-27062 WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability WPFunnels Team / WPFunnels | Средний | 4.3 | — | 29.10.2026 | ||
| CVE-2026-115300 Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF Unknown / Contact Form by Supsystic | Высокий | 4.3 | — | PoC | 29.10.2026 | |
| CVE-2026-115299 Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF Unknown / Contact Form by Supsystic | Высокий | 5.4 | — | PoC | 29.10.2026 | |
| CVE-2026-110983 WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF Unknown / WP Photo Album Plus | Высокий | 4.3 | — | PoC | 29.10.2026 | |
| CVE-2026-118266 Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method labstack / echo · github.com/labstack/echo/v5 | Средний | 5.3 | — | Патч | 28.10.2026 | |
| CVE-2026-116863 WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability Tribulant Software / Newsletters | Критический | 9.6 | 0,18 % | 27.10.2026 | ||
| CVE-2026-92797 Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter MemberPress / Memberpress | Высокий | 8.8 | 0,15 % | 28.10.2026 | ||
| CVE-2026-116839 A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site... Ubiquiti Inc / airMAX M | Высокий | 7.1 | 0,1 % | 27.10.2026 | ||
| CVE-2026-91300 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web... Oracle Corporation / JD Edwards EnterpriseOne Tools | Низкий | 3.1 | 0,22 % | 21.10.2026 | ||
| CVE-2026-93631 Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Linking Zimbra / Zimbra Collaboration Suite · synacor / zimbra_collaboration_suite | Критический | 7.1 | 0,14 % | PoC | 23.10.2026 | |
| CVE-2026-62322 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign) python-social-auth / social-core | Средний | 6.5 | 0,15 % | 15.10.2026 | ||
| CVE-2026-114662 Obot before 0.26.0 API Key Theft via CLI Login Token Request obot-platform / obot | Высокий | 8.6 | 0,17 % | 22.10.2026 | ||
| CVE-2023-3055 The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versio azexo / page_builder_with_image_map_by_azexo | Средний | 4.3 | 0,21 % | Патч | 03.06.2023 | |
| CVE-2026-113486 Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF Unknown / Media Library Assistant | Высокий | 6.5 | 0,11 % | PoC | 28.10.2026 | |
| CVE-2026-113485 Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF Unknown / Media Library Assistant | Высокий | 6.5 | 0,11 % | PoC | 28.10.2026 | |
| CVE-2026-114089 Trigger.dev before 4.5.2 CLI Auth-Code Phishing Leading to PAT Takeover triggerdotdev / trigger.dev | Критический | 8.7 | 0,15 % | PoC | 21.10.2026 | |
| CVE-2026-111120 VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task e4jvikwp / VikRentCar Car Rental Management System | Высокий | 8.8 | 0,32 % | 28.10.2026 | ||
| CVE-2015-20129 CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers... Продукт уточняется | Высокий | 8.6 | 0,15 % | 28.10.2026 | ||
| CVE-2026-84312 Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF) 0xJacky / nginx-ui · github.com/0xJacky/Nginx-UI | Высокий | 7.1 | 0,17 % | Патч | 13.10.2026 | |
| CVE-2025-26926 WordPress Booknetic plugin < 5.10.4 - Cross Site Request Forgery (CSRF) vulnerability Booknetic / Booknetic | Средний | 4.3 | 0,16 % | 25.02.2025 | ||
| CVE-2026-76297 Federated Search Provider State Change through Cross-Site Request Forgery (CSRF) in Splunk Web for Splunk Enterprise Splunk / Splunk Enterprise | Средний | 4.2 | 0,11 % | 22.10.2026 | ||
| CVE-2026-114093 Trigger.dev before 4.5.6 Cross-Site Request Forgery via /logout Endpoint triggerdotdev / trigger.dev | Высокий | 5.3 | 0,19 % | PoC | 21.10.2026 | |
| CVE-2026-114048 WWBN AVideo before 24.0 CSRF via Legacy Playlist and Video Endpoints WWBN / AVideo | Высокий | 5.1 | 0,17 % | PoC | 21.10.2026 |
Информация справочная. Применимость и автоматические рекомендации проверяйте по первичному бюллетеню.