Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-9591
Not yet scoredAwaiting CVSS assessment
Published
June 17, 2026
Affected
1 project
Assigned by
596c5446-0ce5-4ba2-aa66-48b3b757a647
Description
Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or modify news items as an administrator via a crafted form submitted to `/api/news-items`, due to missing anti-CSRF protection.
simplcommerce/SimplCommerce
GitHubA simple, cross platform, modulith ecommerce system built on .NET
GitHubA simple, cross platform, modulith ecommerce system built on .NETNVD