CVE-2026-31954: Emlog

High severity, CVSS 7.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Emlog is an open source website building system. In 2.6.6 and earlier, the delete_async action (asynchronous delete) lacks a call to LoginAuth::checkToken(), enabling CSRF attacks.

Affected products

• Emlog Emlog: up to and including 2.6.6

Published 2026-03-11. Last modified 2026-06-17.