Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-352: Cross-site request forgery (CSRF)

9,923 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 6 of them as exploited in the wild.

All 9,923 in the listAtom feed of new CVEsWhat CWE-352 is, at MITRE (opens in a new tab)
Published CVEs
9,923
Last 12 months
1,430
Critical
151
Known exploited
6

Critical 151High 3,517Medium 6,089Low 163Not scored 3

CVEs per yearBy the year they were published

  1. 2015241
  2. 201681
  3. 2017315
  4. 2018453
  5. 2019543
  6. 2020400
  7. 2021467
  8. 2022702
  9. 20231,306
  10. 20241,421
  11. 20251,922
  12. 20261,182

Known exploitedNewest addition to KEV first

  • CVE-2025-62593

    Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack

    ray-project · ray

    ExploitedCritical9.4
  • CVE-2008-4128

    Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow…

    Product not named

    ExploitedHigh8.1
  • CVE-2023-2533

    PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF

    PaperCut · PaperCut NG/MF

    ExploitedHigh8.4
  • CVE-2014-100005

    Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the…

    Product not named

    ExploitedHigh8.0
  • CVE-2016-6277

    NETGEAR R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta,…

    Product not named

    ExploitedHigh8.8
  • CVE-2020-10181

    goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a…

    Product not named

    ExploitedCritical9.8

Newest CVEs

  • CVE-2026-123545

    OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow

    OpenIdentityPlatform · OpenAM

    High7.1
  • CVE-2026-123495

    Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback

    go-vikunja · vikunja

    Medium5.1
  • CVE-2026-123494

    Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks

    go-vikunja · vikunja

    Medium5.1
  • CVE-2026-121783

    WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability

    Passionate Programmer Peter · WP Data Access

    Medium6.5
  • CVE-2026-121762

    WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability

    Blubrry Podcasting · PowerPress Podcasting

    High8.8
  • CVE-2026-119484

    WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability

    Supsystic · Photo Gallery by Supsystic

    Medium6.3
  • CVE-2026-66669

    WordPress Superb Addons: Blocks, Patterns &amp; theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability

    Suplugins · Superb Addons: Blocks, Patterns &amp; Theme Designer

    High8.8
  • CVE-2026-122675

    WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability

    Wpmet · Wp Social

    Medium5.4
  • CVE-2026-122001

    Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF

    Unknown · Komfortkasse for WooCommerce

    High8.8
  • CVE-2026-117588

    WP Google Review Slider < 18.11 - Google API Settings Update via CSRF

    Unknown · WP Google Review Slider

    Medium4.3

Vendors it comes up for most

  1. Jenkins project238
  2. IBM126
  3. Oracle Corporation81
  4. Cisco58
  5. Drupal37
  6. SourceCodester37
  7. Google34
  8. Concrete CMS33
  9. WWBN33
  10. Apache Software Foundation30