https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 20:52:33 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-57469 <p>Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim&#39;s browser to submit crafted requests.</p> <p>Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim&#39;s browser to submit crafted requests.</p> https://db.gcve.eu/vuln/fkie_cve-2026-57469 https://db.gcve.eu/vuln/ghsa-hx5m-v9rj-h34v <p>Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim&#39;s browser to submit crafted requests.</p> <p>Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator, including deletion of project and configuration files and reset of the control runtime, by inducing the victim&#39;s browser to submit crafted requests.</p> https://db.gcve.eu/vuln/ghsa-hx5m-v9rj-h34v https://db.gcve.eu/vuln/ppsa-2026-005 <p>The &#39;Pictory&#39; web config tool, prior to 2.17.0, has a Cross-Site Request Forgery (CSRF) vulnerability, which makes it vulnerable to session takeover. The &#39;revpipyload&#39; package, prior to version 0.11.1, has a vulnerability in the file management functionality of its XML-RPC interface. This allows an attacker to access or delete arbitrary files that the &#39;revpipyload&#39; process has access to.</p> <p>The &#39;Pictory&#39; web config tool, prior to 2.17.0, has a Cross-Site Request Forgery (CSRF) vulnerability, which makes it vulnerable to session takeover. The &#39;revpipyload&#39; package, prior to version 0.11.1, has a vulnerability in the file management functionality of its XML-RPC interface. This allows an attacker to access or delete arbitrary files that the &#39;revpipyload&#39; process has access to.</p> https://db.gcve.eu/vuln/ppsa-2026-005