https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 15:40:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-380362 EUVD-2026-380362 https://cve.radiocsirt.org/vuln/euvd-2026-380362 https://cve.radiocsirt.org/vuln/fkie_cve-2026-61502 <p>Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator&#39;s browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server&#39;s own machine.</p> <p>Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator&#39;s browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server&#39;s own machine.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-61502 https://cve.radiocsirt.org/vuln/ghsa-53v3-qjv8-5264 <p>Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator&#39;s browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server&#39;s own machine.</p> <p>Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator&#39;s browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server&#39;s own machine.</p> https://cve.radiocsirt.org/vuln/ghsa-53v3-qjv8-5264