CVE-2026-101086: Improper Privilege Management

Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service API. Attackers can deliver command execution or Agent configuration tasks to...

CVE-2026-101089: Insufficiently Protected Credentials

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-100862: Cleartext Storage of Sensitive Information

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100859: Server-Side Request Forgery (SSRF)

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the serv...

CVE-2026-101050: Improper Authentication

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...

CVE-2026-100855: Missing Authorization

AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/stationid/file/id/play endpoint that allows authenticated users to download media files from any station. Attackers can enumerate media files using sequential IDs and exfiltrate the complete media...

CVE-2026-100851: Exposure of Sensitive Information to an Unauthorized Actor

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

PT-2026-99471

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description Broken access control allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. By calling the 'GET /api/station/id/vue/profil...

CVE-2026-101085: Numeric Truncation Error

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint t...

PT-2026-99714

Name of the Vulnerable Software and Affected Versions Nezha Dashboard versions prior to 2.3.5 Description Authenticated users with nezha:service:write scope can submit privileged task types through the service API because the system fails to restrict service monitor task types to supported probe...

PT-2026-99470

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description An issue exists in the AutoDJ remote playlist fetch functionality within the getMediaFromRemoteUrl function. A user with station Media permissions can create or update a playlist by setting source...

CVE-2026-101088: Time-of-check Time-of-use (TOCTOU) Race Condition

Nezha is a server and website monitoring tool. In versions = 2.2.11 and 2.3.1, the service sentinel worker service/singleton/servicesentinel.go contains an incomplete fix for a previously reported nil dereference denial of service GHSA-qjpp-gffx-2wm9. The 2026-07-21 fix re-validated the service...

PT-2026-99479

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.106 Description An issue exists in the 'POST /api/credentials/test' endpoint that allows collaborators with shared credential access to exfiltrate the secret of the credential owner. An attacker can override the...

PT-2026-99467

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description A DQL injection issue exists in the AbstractSearchableListAction.php file. An attacker can inject arbitrary DQL Doctrine Query Language expressions—an object-oriented query language used by the...

Exploit for Interpretation Conflict in Wordpress

LANGZ — wp2shell Exploit Tool Author: LANGZ CVE: CV...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: chartmuseum, newrelic-infrastructure-agent, buildkitd, cluster-api-helm-controller, helm-operator, kaniko, neuvector-scanner, docker-compose, docker, rancher, helm-mapkubeapis, skaffold, steampipe, zot, spegel, dagger, kubescape-operator, headlamp, wolfictl,...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the cachesalt field across multiple API protocol handlers Anthropic, OpenAI chat completion...

CVE-2026-100720

Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer the lowest-privileged authenticated role uploads an SSL certificate for one of their own domains, the Certificates API add/update methods parse it with opensslx509parse and store the issuer organization...

CVE-2026-100719

Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password hashes. Authenticated API users can retrieve bcrypt password hashes for protected-directory users, enabling offline cracking attempts and exposure ...

CVE-2026-100714

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no stringregexp or requiredotp guard, and its value is concatenated unescaped into the acme.sh command line built in...