CWE-352

Medium likelihood

Cross-Site Request Forgery (CSRF)

Parent: CWE-345 - Insufficient Verification of Data Authenticity

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

9,489 vulnerabilities with CWE-352
CVE-2026-11265 HIGH
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Autofill
CVSS 7.5
CVE-2026-11214 MEDIUM
Chrome for iOS < 149.0.7827.53 - Cross-Origin Data Leak via Crafted HTML Page
CVSS 6.5
CVE-2026-11200 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via WebRTC
CVSS 6.5
CVE-2026-11195 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via MHTML
CVSS 6.5
CVE-2026-11194 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Network Implementation
CVSS 6.5
CVE-2026-11156 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via CSS Implementation
CVSS 4.3
CVE-2026-11155 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via CSS
CVSS 4.3
CVE-2026-11148 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Payments Implementation
CVSS 6.5
CVE-2026-11139 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Paint Implementation
CVSS 6.5
CVE-2026-11134 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Media Component
CVSS 6.5
CVE-2026-11129 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Extensions
CVSS 6.5
CVE-2026-11106 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Media Component
CVSS 6.5
CVE-2026-11084 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Password Manager
CVSS 6.5
CVE-2026-11083 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Password Manager
CVSS 6.5
CVE-2026-11020 MEDIUM
Google Chrome < 149.0.7827.53 - Cross-Origin Data Leak via Crafted XML File
CVSS 6.5
CVE-2026-43985 HIGH
Tautulli < 2.17.1 - CSRF Admin Credential Takeover
CVSS 8.8
CVE-2026-9732 MEDIUM
EmergencyWP <= 1.4.2 - Cross-Site Request Forgery to Plugin Settings Update
CVSS 4.3
CVE-2026-42073 MEDIUM
OpenClaude's MCP OAuth Callback: State Check Bypass via error Param Leads to DoS
CVSS 6.5
CVE-2026-34460 MEDIUM
NamelessMC: OAuth callback `state` is not validated, allowing login CSRF / session swapping
CVSS 5.4
CVE-2026-9730 MEDIUM
Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update
CVSS 4.3
CVE-2026-9723 MEDIUM
Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page
CVSS 4.3
CVE-2026-9722 MEDIUM
Laiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form
CVSS 4.3
CVE-2026-9599 MEDIUM
Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update
CVSS 4.3
CVE-2026-8422 MEDIUM
Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update
CVSS 4.3
CVE-2026-4071 MEDIUM
BirdSeed <= 2.2.0 - Cross-Site Request Forgery via BirdSeed Token Change
CVSS 4.3
Details
Vulnerabilities 9,489
Exploit Likelihood Medium
Links
MITRE CWE Entry Search this CWE With Exploits