PULSE
EN
FEED
ransompanzer reclama a Family Planning Association of Pakistan · PK · Healthcareransomdeadlock reclama a Hensel Elektrik · DE · Manufacturingransomrhysida reclama a Sanders Law Group · Professional Servicesransomqilin reclama a Miljaus Producciones S.L (www.miljaus.com) · ES · Otherransomqilin reclama a von Schaewen · DE · Otherransomn0n reclama a Company #110 · ES · Not Foundransomchaos reclama a mickeybody.com · US · Retail & E-Commerceransomaurora reclama a ARX Group SA · CH · Otherransomwhitearmor reclama a whitearmor.cc · Technologyransomlockbit5 reclama a dorsiacademy.it · IT · Educationransomlockbit5 reclama a mlh.com.lb · LB · Professional Servicesransomlockbit5 reclama a lidoway.com · LI · Not Foundransomlockbit5 reclama a zelsior.es · ES · Not Foundransomemperador reclama a JS Constructor, INC · US · Manufacturingransompanzer reclama a Family Planning Association of Pakistan · PK · Healthcareransomdeadlock reclama a Hensel Elektrik · DE · Manufacturingransomrhysida reclama a Sanders Law Group · Professional Servicesransomqilin reclama a Miljaus Producciones S.L (www.miljaus.com) · ES · Otherransomqilin reclama a von Schaewen · DE · Otherransomn0n reclama a Company #110 · ES · Not Foundransomchaos reclama a mickeybody.com · US · Retail & E-Commerceransomaurora reclama a ARX Group SA · CH · Otherransomwhitearmor reclama a whitearmor.cc · Technologyransomlockbit5 reclama a dorsiacademy.it · IT · Educationransomlockbit5 reclama a mlh.com.lb · LB · Professional Servicesransomlockbit5 reclama a lidoway.com · LI · Not Foundransomlockbit5 reclama a zelsior.es · ES · Not Foundransomemperador reclama a JS Constructor, INC · US · Manufacturing
← Todos los CVEs
CVE Watch15 oct 2026

CVE-2026-48211

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) a

CVSS

5.4

Medio

EPSS

0.1%

p2

KEV

—

Exploit Today

0

0-100

Publicado: 12 oct 2026 · Última mod.: 15 oct 2026 · CWE-352

EPSS · 30d
0.1%EPSS · 30 días0.1%
2026-10-122026-10-23
Descripción técnica

An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack. The OTRS AdminImportExport::TemplateDelete action does not validate the request's ChallengeToken, allowing an unauthenticated remote attacker to craft a malicious request that is executed with the privileges of an active administrator session. This issue affects OTRS: * 7.0.X * 8.0.X * 2023.X * 2024.X * 2025.X * 2026.X before 2026.7.X Please note that ((OTRS)) Community Edition 6.x and before are vulnerable. Products based on the ((OTRS)) Community Edition also very likely to be affected

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1157964.3 MED
—
———A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.11hCVE-2026-58497—
—
———Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.10hCVE-2026-936317.1 ALT
—
———A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's mailbox. The OAuth callback does not bind its state value or authorization code to the initiating Zimbra session and instead selects the destination mailbox from the browser's current authentication cookie. On a deployment with the provider configured, an attacker can induce a signed-in victim to load a callback containing a fresh code for the attacker's provider account. This creates a persistent data source that imports attacker-controlled contacts or events. With bidirectional CalDAV synchronization, appointments subsequently created or edited in the linked calendar are also disclosed to the attacker. ZCS 10.1.16 and 10.1.20 are affected.14hCVE-2026-75779—
63.9%
——19Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.11hCVE-2026-115494—
8.3%
——3A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to perform a CSRF attack with passive user interaction. This means the state of a resource could be changed without the user noticing. As a workaround, an API gateway for firewall in front of KNIME Business Hub could remove the X-Forwaded-For header from all incoming requests.1dCVE-2026-1141778.8 ALT
2.6%
——1Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.2d