PT-2026-104049

Name of the Vulnerable Software and Affected Versions infiniflow ragflow version 0.25.3 Description Improper access control exists in the resume function within the 'api/apps/connector app.py' endpoint. This flaw allows an attacker to execute unauthorized cross-session or privilege-crossing...

PT-2026-104019

Name of the Vulnerable Software and Affected Versions PictShare versions prior to 3.7.1 Description An information disclosure issue exists where unauthenticated attackers can obtain the secret delete code and uploader metadata. This occurs when calling the 'API::info' endpoint, which returns the...

PT-2026-103969

🚨 CVE-2026-104059 Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, ...

CVE-2026-12405: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

CVE-2026-103271: Incorrect Authorization

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-101147: Cross-Site Request Forgery (CSRF)

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

PT-2026-105807

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug...

PT-2026-105819

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

PT-2026-103939

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

CVE-2026-96255: Exposure of Sensitive Information to an Unauthorized Actor

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

PT-2026-104050

Name of the Vulnerable Software and Affected Versions RAGFlow version 0.24.0 Description Improper access control exists in the get dataset function within the 'api/apps/evaluation app' endpoint. This flaw allows an attacker to trigger the execution of arbitrary code or commands controlled by the...

CVE-2026-104059: Cross-Site Request Forgery (CSRF)

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

PT-2026-103981

Name of the Vulnerable Software and Affected Versions Joyland AI affected versions not specified Description The application contains hard-coded credentials for the GeTui push notification service. This allows an attacker to access the GeTui REST API and send push notifications with arbitrary...

CVE-2026-67104: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...

PT-2026-105543

Summary /api/block/getRefIDs filters its results for reader roles through a helper that checks only the visibility tiers. The password tier is not checked, because the helper does not receive the request context and therefore cannot evaluate the publish auth cookie. A reader who has not entered a...

CVE-2026-51888

The langflow-ai langflow software, specifically versions up to 1.8.4 , is vulnerable to an absolute path traversal vulnerability in the knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge_base endpoint. The root cause is a lack of boundary enforcement in src/backend/base/la...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...