Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatcher. The manipulation of the argument _method leads to cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-09 | 1 | Disclosure1 |
| 2026-05-10 | 1 | General1 |
| 2026-05-11 | 1 | Patch1 |
CVE-2026-8194 A security vulnerability has been detected in osTicket up to 1.18.3. Impacted is an unknown function of the file include/class.dispatcher.php of the component Dispatche… https://www.cve.org/CVERecord?id=CVE-2026-8194
Post summary
The post announces CVE-2026-8194 in osTicket up to 1.18.3, but offers no details on exploitation, patching, or technical specifics.
🚨 New CVEs w/ exploits: osTicket CSRF (CVE-2026-8194), Canias ERP RCE (CVE-2026-8217), GDAL overflow & more. Linux 'Dirty Frag' LPE chain for root (CVE-2026-43284/43500). HN buzz: AI fatigue, cloud costs, local AI. Patch fast! Simplify stacks. #infosec #Linux
Post summary
The post lists several new CVEs with exploit details and urges timely patching to mitigate potential risks.
CVE-2026-8194 Cross-Site Request Forgery in osTicket Up to 1.18.3 via _method Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8194
Post summary
The post announces a new CSRF vulnerability in osTicket ≤1.18.3 involving the _method parameter, without indicating any PoC, exploit code, active use, or patch.