CVE WatchNov 10, 2026

CVE-2026-112137

A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >=

CVSS

5.4

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-352

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server.

Official references

cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-710379.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1253396.1 MED

—

——0Winter CMS is a content management system built on the Laravel PHP framework. From 1.0.319 until 1.2.14, Backend\Classes\Controller::actionExists() accepts public handler-shaped methods as page actions, so a top-level GET request can invoke state-changing backend AJAX handlers without a CSRF token. Because backend routes use Route::any, CSRF validation skips GET, and the default SameSite=Lax session cookie is sent on cross-site navigation, an unauthenticated attacker can induce an authorized backend user to follow a link such as /backend/system/eventlogs/index_onEmptyLog. Affected handlers in the backend, CMS, and system modules can truncate logs, reset settings, alter backend user state, or delete CMS templates, while URL path segments can select a target record. This issue is fixed in version 1.2.14.3h CVE-2026-1181526.5 MED

—

——0Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.3h CVE-2026-1094817.5 HIG

—

——0Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.4h CVE-2026-1242518.8 HIG

—

——0Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.This issue affects WPIDE – File Manager & Code Editor: from n/a through 3.6.4.6h CVE-2026-600418.1 HIG

9.1%

——3An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.6h CVE-2026-891314.3 MED

1.1%

——0SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action on the server. Successful exploitation could allow the attacker to modify non-sensitive information, resulting in a low impact on integrity. There is no impact on confidentiality and availability.22h