https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:58:38 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-72849 <p>Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim&#39;s account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user&#39;s account, enabling impersonation within agent operations and inheritance of victim permissions.</p> <p>Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim&#39;s account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user&#39;s account, enabling impersonation within agent operations and inheritance of victim permissions.</p> https://db.gcve.eu/vuln/fkie_cve-2026-72849 https://db.gcve.eu/vuln/ghsa-4q4m-8h83-fcmr <p>Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim&#39;s account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user&#39;s account, enabling impersonation within agent operations and inheritance of victim permissions.</p> <p>Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim&#39;s account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user&#39;s account, enabling impersonation within agent operations and inheritance of victim permissions.</p> https://db.gcve.eu/vuln/ghsa-4q4m-8h83-fcmr