PULSE
EN VIVO36señales / 24h
EN
FEED
ransomunsafe reclama a Presentations.AI · US · Technologyransomakira reclama a Alcast · Manufacturingransompanzer reclama a The Minor Food Group · TH · Agriculture and Food Productionransomakira reclama a One Vision Imaging · Healthcareransomakira reclama a i4 Solutions · Technologyransomglobal secret group reclama a MACOFIN HELLAS S.A. · GR · Financial Servicesransomqilin reclama a City of Winchester · US · Government & Defenseransomqilin reclama a B Wright Drywall · US · Manufacturingransomglobal secret group reclama a Cook Remodeling · US · Otherransomstorm reclama a Southern Metals · US · Manufacturingransomstorm reclama a TRP International · US · Otherransomstorm reclama a Supportive Insurance Services · US · Financial Servicesransomwallstreet reclama a T.RAD North America · US · Technologyransomwallstreet reclama a Black Hills Bentonite · US · Manufacturingransomunsafe reclama a Presentations.AI · US · Technologyransomakira reclama a Alcast · Manufacturingransompanzer reclama a The Minor Food Group · TH · Agriculture and Food Productionransomakira reclama a One Vision Imaging · Healthcareransomakira reclama a i4 Solutions · Technologyransomglobal secret group reclama a MACOFIN HELLAS S.A. · GR · Financial Servicesransomqilin reclama a City of Winchester · US · Government & Defenseransomqilin reclama a B Wright Drywall · US · Manufacturingransomglobal secret group reclama a Cook Remodeling · US · Otherransomstorm reclama a Southern Metals · US · Manufacturingransomstorm reclama a TRP International · US · Otherransomstorm reclama a Supportive Insurance Services · US · Financial Servicesransomwallstreet reclama a T.RAD North America · US · Technologyransomwallstreet reclama a Black Hills Bentonite · US · Manufacturing
← Todos los CVEs
CVE Watch10 ago 2026

CVE-2026-66642

Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from n/a

CVSS

5.4

Medio

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 10 ago 2026 · Última mod.: 10 ago 2026 · CWE-352

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from n/a through 2.26.2.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-725788.8 ALT
—
——0A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The /admin/ajax.php dispatcher in amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php does not implement CSRF tokens; its only protection is a Referer header check that is bypassed when the request is sent without a Referer header or from a same-site context, enabling attackers to trigger admin operations by luring an administrator to a malicious page.4hCVE-2026-464099.6 CRÍ
29.0%
——9OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to `127.0.0.1:<random port>` (commonly 19141) without server-side Origin validation, loopback authentication, or Content-Type enforcement, and with a wildcard CORS policy. Any webpage a user visits while OpenYak is running can issue cross-origin requests to this local server — the browser acts as a proxy into loopback, bypassing OS-level network isolation. Chained, this lets a malicious page execute arbitrary shell commands on the host (RCE) via the build agent with `permission_presets.bash=true`, shut down the service, and exfiltrate chat history and account PII — with no user interaction beyond opening the page. Version 1.1.3 patches the issue.3dCVE-2026-162627.5 ALT
5.5%
——2The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.3dCVE-2026-666866.5 MED
2.4%
——1Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.4dCVE-2026-666814.3 MED
1.7%
——1Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.4dCVE-2026-281727.1 ALT
0.9%
——0Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.4d