CVE-2026-112050
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to the
CVSS
3.1
Baixa
EPSS
0.1%
p4
KEV
—
Exploit Today
1
0-100
Publicado: 18 de out. de 2026 · Última mod.: 19 de out. de 2026 · CWE-352
0.1%EPSS · 30 dias0.1%
2026-10-192026-11-06
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.
- github.comhttps://github.com/gitify-app/gitify/blob/v7.9.0/src/renderer/utils/forges/github/flows.ts#L35-L76
- github.comhttps://github.com/gitify-app/gitify/commit/10235b243e167a7c76eafd6a3d0ebc8c575eebc7
- github.comhttps://github.com/gitify-app/gitify/issues/3425
- github.comhttps://github.com/gitify-app/gitify/releases/tag/v7.10.0
- www.vulncheck.comhttps://www.vulncheck.com/advisories/gitify-before-7.10.0-login-csrf-via-missing-oauth-state-validation
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1217836.5 MÉD—
———Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affects WP Data Access: from n/a through 5.5.90.7hCVE-2026-1217628.8 ALT—
———Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.18.0.8hCVE-2026-1194846.3 MÉD—
———Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6.8hCVE-2026-666698.8 ALT—
———Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.9hCVE-2026-1226755.4 MÉD—
———Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3.9hCVE-2026-173695.4 MÉD—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to force a user to authenticate into an attacker-controlled account due to cross-site request forgery. The sign-in flow does not sufficiently verify that a login response belongs to the user's own request, which could link the victim's session to an account controlled by the attacker.13h