CWE-352: Cross-site request forgery (CSRF)
9,898 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 6 of them as exploited in the wild.
- Published CVEs
- 9,898
- Last 12 months
- 1,429
- Critical
- 149
- Known exploited
- 6
Critical 149High 3,510Medium 6,069Low 163Not scored 7
CVEs per yearBy the year they were published
- 201989
- 2022245
- 2023195
- 2023166
- 20251,498
- 20251,184
- 2026981
- 20261,742
- 2026735
- 2026512
- 2026511
- 2026289
Known exploitedNewest addition to KEV first
- CVE-2025-62593
Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack
ray-project · ray
ExploitedCritical9.4 - CVE-2008-4128
Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow…
Product not named
ExploitedHigh8.1 - CVE-2023-2533
PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF
PaperCut · PaperCut NG/MF
ExploitedHigh8.4 - CVE-2014-100005
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the…
Product not named
ExploitedHigh8.0 - CVE-2016-6277
NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta,…
Product not named
ExploitedHigh8.8 - CVE-2020-10181
goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a…
Product not named
ExploitedCritical9.8
Newest CVEs
- CVE-2026-120640
CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields
CGI
Not scored - CVE-2026-110288
Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console
GitHub · Enterprise Server
Medium5.3 - CVE-2026-63433
MyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value
franklioxygen · MyTube
Medium6.8 - CVE-2026-121451
AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF
amir1376 · ab-download-manager
High8.7 - CVE-2026-103420
Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5
php-web-design.com · StageIt extension for Joomla
High7.2 - CVE-2026-120249
Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
Thelia · Thelia Back-office Default Twig Template
Medium6.9 - CVE-2026-120207
Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes
Thelia · Thelia Page Module
High7.0 - CVE-2026-120206
Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
Thelia · Thelia
Medium5.9 - CVE-2026-61826
Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
morpheus65535 · bazarr
Critical10.0 - CVE-2026-119466
WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability
WPExperts · APIExperts Square for WooCommerce
Medium5.4