CVE-2026-51867

The software agentgpt v.1.0.0 is vulnerable to Incorrect Access Control within the next/src/server/api/routers/agentRouter.ts component. The issue stems from an externally reachable path that accepts a caller-selected object or tenant identifier, allowing it to perform data-access operations with...

CVE-2026-51867

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...

EUVD-2026-90415

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...

CVE-2026-51861: Improper Control of Generation of Code

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

CVE-2026-51867

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...

CVE-2026-51861

The software bisheng versions 2.3.0 , 2.4.0 , and 2.4.0-beta1 are vulnerable to Code Injection (CWE-94). The flaw is located within the src/backend/bisheng/api/v1/validate.py component. This vulnerability allows for unauthorized code execution, which can lead to high impact on confidentiality , i...

CVE-2026-51861

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

EUVD-2026-90419

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

PT-2026-103612

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

CVE-2026-51861

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

PT-2026-103616

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...

CVE-2026-51869

The DB-GPT v0.8.0 sandbox API contains a security weakness where it silently falls back to LocalRuntime . This flaw allows an attacker to execute arbitrary code on the host system. The vulnerability is associated with CWE-284 (Improper Access Control) and has a CRITICAL CVSS 3.1 base score of 9.8...

PT-2026-103032

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

CVE-2026-94274: Exposure of Sensitive Information to an Unauthorized Actor

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content...

CVE-2026-55177: Server-Side Request Forgery (SSRF)

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-103111: Out-of-bounds Write

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

CVE-2026-103111: Out-of-bounds Write

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

PT-2026-103072

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 13.1.0 Description An authenticated user can list alert rules stored in folders they are not allowed to read via the alert rules API list endpoint. If the set of folders the user is permitted to read is empty, the...

PT-2026-102963

Name of the Vulnerable Software and Affected Versions AiSOC versions 9.0.0 through 11.9.9 Description Authentication is not enforced on the response-action API endpoints when AISOC DEV MODE is enabled and AISOC ACTIONS SERVICE TOKEN is empty within the default Docker Compose deployment. This allo...

CVE-2026-103111: Out-of-bounds Write

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...