CVE-2026-83560: Exposure of Sensitive Information to an Unauthorized Actor

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

CVE-2026-102134: Unprotected Alternate Channel

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and...

CVE-2024-58387: Improper Limitation of a Pathname to a Restricted Directory

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...

CVE-2026-76570: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request...

CVE-2026-103270: Missing Authentication for Critical Function

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pausegeneration, /abortrequest, /flushcache, and /initweightsupdategroup to disrupt inference operations and wedge workers o...

CVE-2026-94274: Exposure of Sensitive Information to an Unauthorized Actor

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content...

CVE-2026-103102: Allocation of Resources Without Limits or Throttling

Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort resulting in a denial of service. Exploitation of this issue requires accessing a gateway call from a WebRTC/API client...

CVE-2026-102794: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...

CVE-2026-102793: Improper Neutralization of Special Elements used in a Command

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function settimezone of the file /api/ZRFirmware/settimezone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-51869: Improper Access Control

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host...

CVE-2026-51866: Improper Control of Generation of Code

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

CVE-2026-51869

The DB-GPT v0.8.0 sandbox API contains a security weakness where it silently falls back to LocalRuntime . This flaw allows an attacker to execute arbitrary code on the host system. The vulnerability is associated with CWE-284 (Improper Access Control) and has a CRITICAL CVSS 3.1 base score of 9.8...

CVE-2026-51861

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

CVE-2026-51869

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host...

CVE-2026-51866

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

CVE-2026-51867

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...

EUVD-2026-90414

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host...

EUVD-2026-90416

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

EUVD-2026-90419

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

EUVD-2026-90415

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on tha...