https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:38:17 +0000 https://cve.radiocsirt.org/vuln/cve-2025-24358 <p><strong>Affected:</strong> gorilla csrf</p> <p>gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications &amp; services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is never populated for &#34;server&#34; requests per the Go spec, and so this check does not run in practice. This vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform authenticated form submissions against gorilla/csrf protected targets that share the same top level domain. This vulnerability is fixed in 1.7.2.</p> <p><strong>Affected:</strong> gorilla csrf</p> <p>gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications &amp; services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is never populated for &#34;server&#34; requests per the Go spec, and so this check does not run in practice. This vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform authenticated form submissions against gorilla/csrf protected targets that share the same top level domain. This vulnerability is fixed in 1.7.2.</p> https://cve.radiocsirt.org/vuln/cve-2025-24358