Skip to content

/

ZeroHour

ZeroHour aggregates public sources — security and AI press, vendor advisories, NVD, CISA KEV, FIRST EPSS, leak-site trackers and Have I Been Pwned — and classifies them with AI. Summaries can be wrong: read the original. All times are UTC.

News CVEs Incidents Tags Daily brief Traffic Sources RSS & API Kiosk Health Sitemap

Home
News feed
Exploited now

Security

CVEs
Ransomware & breaches
Threat actors & entities
IOCs

AI

AI & models

Explore

Tags
Daily brief
Analytics
Traffic & readers
Ask the feed
Sources

You

Watchlist
Saved
RSS, API & alerts

06:59 UTC· 7m ago

#csrf — news, CVEs and analysis · ZeroHour

today 43 visits · 56 views · 7 reads·all time 17K views

Tag

#csrf

7 stories this week · 13 this month · 20 in 6 months · mostly security

stories per day · 30 days

Related#wordpress 7 #click2shell 4 #patchstack 4 #rce 4 #elementor 3 #privilege-escalation 3 #account-takeover 2 #cisa 2 #patch 2 #selector-injection 2 #web-security 2 #xss 2 #active-exploitation 1 #ansi2html 1 #apache 1 #apache-roller 1 #arista 1 #authorization-bypass 1

18 stories, newest first · one card per story

Patchstack·21h ago high

Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites

#elementor #wordpress #csrf

3 sources 9 min

oss-security·1d ago

CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation

#apache-roller #csrf #cve-2026-82380

CVE-2026-82380

Lobsters · security·1d ago

SourceHut account takeover via build logs (XSS in ansi2html.py)

#sourcehut #xss #ansi2html

Vulnerability

3 sources 12 min

BleepingComputer·1d ago high

WordPress Click2Shell flaw lets hackers execute PHP on the server

#wordpress #click2shell #csrf

6 sources 3 min

CSO Online·2d ago critical

On-prem VeloCloud Orchestrator under attack, only some versions patched

#arista #velocloud #sd-wan

5 sources in the wild 3 min

Cyber Security News·8d ago high

Click2Shell WordPress Flaw Lets Attackers Gain RCE With a Single Malicious Link

#click2shell #csrf #exploit-chain

4 min1

Patchstack·8d ago high

Click2Shell: The RCE WordPress 7.1.1 Just Patched

#click2shell #csrf #jquery

4 min1

The Hacker News·8d ago high

New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution

#click2shell #csrf #patch

3 min2

SANS Internet Storm Center·9d ago

HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)

#cache-poisoning #csrf #http

Research

4 min

CISA Advisories·16d ago high

ST Engineering iDirect iQ-Series Terminals (Update A)

#cisa #csrf #information-disclosure

CVE-2026-38059

6 min

CISA Advisories·23d ago

Tycon Systems TPDIN-Monitor-WEB3

#authorization-bypass #cisa #csrf

CVE-2026-77847

2 sources 4 min

CISA Advisories·Aug 27, 2026

Ebyte NA111-M

#advisory #authentication #csrf

CVE-2026-73125

Security Affairs·Aug 22, 2026 high

Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution

#ait-gui #ammos #authentication

4 min1

The Hacker News·Aug 20, 2026 high

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

#ait-gui #csrf #cycode

7 min1

Security Affairs·Aug 18, 2026 high

GitLab Patches Critical Unauthenticated GraphQL Vulnerability

#csrf #devops #gitlab

2 min1

Help Net Security·Aug 18, 2026 high

Critical GitLab flaw allows attackers to modify or delete public projects (CVE-2026-19478)

#code-injection #csrf #gitlab

1

The Hacker News·Aug 17, 2026 high

Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects

#csrf #devops #gitlab

2 min1

Exploit-DB·Aug 17, 2026

[webapps] webpack_devserver 5.2.5 - CSRF

#csrf #devserver #exploit

Exploit / PoC

1