https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T16:43:55.502985+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-191873 EUVD-2026-191873 2026-10-09T16:43:55.506403+00:00 EUVD-2026-191873 https://cve.radiocsirt.org/vuln/fkie_cve-2023-4455 fkie_cve-2023-4455 2026-10-09T16:43:55.506436+00:00

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

 https://cve.radiocsirt.org/vuln/ghsa-gjvc-55fw-v6vq GHSA-gjvc-55fw-v6vq — Wallabag user can delete own API client unintentionally 2026-10-09T16:43:55.506467+00:00

Affected: Packagist: wallabag/wallabag

# Description wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete API key via `/developer/client/delete/{id}`

This vulnerability has a CVSSv3.1 score of 6.5.

**You should immediately patch your instance to version 2.6.3 or higher if you have more than one user and/or having open registration**.

# Resolution

This action is now doable only via POST method, which ensures that we can't do it via a 3rd-party website.

# Credits

We would like to thank @tht1997 for reporting this issue through huntr.dev.

Reference: https://huntr.dev/bounties/5ab1b206-5fe8-4737-b275-d705e76f193a/

 https://cve.radiocsirt.org/vuln/gsd-2023-4455 gsd-2023-4455 2026-10-09T16:43:55.506501+00:00 gsd-2023-4455