Skip to content
Threat Feed
Subscribe

Tag

Cross-Site Request Forgery

2 briefs RSS
high advisory

CVE-2026-58143 - Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows una...

A Cross-Site Request Forgery (CSRF) vulnerability in Cotonti Siena versions 0.9.26 and earlier allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request, enabling the upload and execution of arbitrary PHP files leading to remote code execution.

Cotonti Siena <= 0.9.26 cross-site-request-forgery vulnerability webserver rce php
1r 3t 1c
high advisory

Go MCP SDK Vulnerable to Cross-Site POST Requests (CVE-2026-33252)

The Go MCP SDK before v1.4.1 is vulnerable to cross-site POST requests due to insufficient origin validation and content type enforcement, potentially leading to arbitrary tool execution on local servers in stateless or sessionless deployments.

cve-2026-33252 cross-site request forgery go-mcp-sdk
1r 1t