CVE-2025-56798

UNKNOWN

Published 2026-08-26 · Source cve@mitre.org

Description

Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy.

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-75466
libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.
2026-08-26 · score —
CVE-2026-75325
DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters.
2026-08-26 · score —
CVE-2026-51106
An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component
2026-08-26 · score —
CVE-2026-36851
Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration.
2026-08-26 · score —
CVE-2026-19485
A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names. This vulnerability was patched and no customer action is needed.
2026-08-26 · score —