CWE-35225 advisories

Cross-Site Request Forgery (CSRF)

What it is

A site accepts state-changing requests without proving they came from its own UI, so another site can forge them.

How to fix it

Upgrade and enable anti-CSRF tokens; set SameSite=Lax/Strict on session cookies.

How to avoid it

Require an unpredictable per-request token on every state-changing endpoint.

Known Cross-Site Request Forgery (CSRF) vulnerabilities

CVE-2026-73222 — high · npm/claude-code-templates
CVE-2026-73292 — high · Go/github.com/semaphoreui/semaphore
CVE-2026-81890 — medium · Packagist/studio-42/elfinder
CVE-2026-19418 — high · Packagist/typo3/cms-backend
CVE-2026-81888 — medium · npm/@hono/oauth-providers
CVE-2026-55532 — high · PyPI/PraisonAI
GHSA-p2ch-c2c3-4xm5 — medium · Packagist/winter/wn-backend-module
CVE-2026-63123 — medium · npm/@tinacms/cli
CVE-2026-55593 — medium · Packagist/froxlor/froxlor
CVE-2026-68923 — medium · PyPI/mobsf
CVE-2023-37465 — medium · Maven/org.xwiki.contrib:discussions-server
GHSA-pvcr-8mvp-w8qr — high · npm/@budibase/server
GHSA-qwww-vcr4-c8h2 — high · npm/react-router
GHSA-8mv7-9c27-98vc — medium · npm/astro
CVE-2026-14620 — medium · npm/webpack-dev-server
CVE-2026-52823 — medium · Packagist/kimai/kimai
CVE-2026-49992 — medium · Packagist/kimai/kimai
CVE-2026-52777 — critical · Packagist/yeswiki/yeswiki
CVE-2026-53760 — medium · Packagist/admidio/admidio
CVE-2026-49471 — high · PyPI/serena-agent
CVE-2026-49455 — medium · npm/waku
CVE-2026-53649 — critical · Go/github.com/BishopFox/joro
GHSA-q855-8rh5-jfgq — medium · PyPI/ha-mcp
CVE-2026-44342 — medium · Go/github.com/QuantumNous/new-api
CVE-2026-52800 — high · Go/gogs.io/gogs

Stateward flags Cross-Site Request Forgery (CSRF) in your own code and dependencies on every pull request.

Scan my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.