CVE-2026-94487

HighCVSS 8.1/10Last modified Sep 23, 2026

Description

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-944888.2Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 CVE-2026-94496.3A vulnerability was identified in code-projects Employee Management System 1.0. This impacts an unknown function of the file /changepassemp.CVE-2026-944917.3A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulatCVE-2026-944926.3A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saCVE-2026-9449310.0A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html ofCVE-2026-944945.0jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GCVE-2026-944957.1jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modCVE-2026-944968.3jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's dataCVE-2026-944978.3jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. AuthenticaCVE-2026-944986.5Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.CVE-2026-944997.1Subscriber Broken Access Control in FormGent <= 1.12.2 versions.CVE-2026-94506.3A security flaw has been discovered in code-projects Employee Management System 1.0. Affected is an unknown function of the file /psubmit.ph
CVE-2026-94487: High severity, CVSS 8.1 | Vulnix