CVE-2026-110762

bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hidesitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permali...

EUVD-2026-101562

bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hidesitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permali...

CVE-2026-110762 bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream

bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hidesitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permali...

CVE-2026-110762

The bbPress plugin (versions before 2.6.19 ) contains an information disclosure vulnerability. The issue arises because the hide_sitewide function fails to account for ancestor forum visibility. Consequently, unauthenticated visitors can access the title, permalink, and body of posts within publi...

CVE-2026-102682

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682

The pipecat-ai Python framework (versions 0.0.98 to 1.6.0 ) contains a vulnerability where the built-in development runner exposes unauthenticated endpoints, including /start, /daily, and /daily-dialin-webhook. These endpoints allow unauthenticated callers to create bot sessions and Daily rooms ,...

CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-100406

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

EUVD-2026-101600

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-100406

The dbt tool (versions 2.0.0-alpha.0 through 2.0.0-alpha.4 ) contains a vulnerability where the dbt docs serve command exposes an unauthenticated POST /api/v1/query endpoint. The root cause is that the crates/dbt-docs-server/src/handlers/query.rs handler passes caller-supplied SQL directly to Duc...

DEBIAN-CVE-2026-86856

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption...

CVE-2026-86856

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption...

CVE-2026-79957

ServiceNext contains an insecure direct object reference IDOR in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account CWE-639. Any authenticated user can iterate the ID...

CVE-2026-54554

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo endpoint in packages/web/lib/fog/fogpage.class.php was reported to return the FOGADDEFAULTPASSWORD value in its domainpass JSON field and to be dispatchable through...

CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-100413

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfssftpsshprivatekey. A standalone deployment presented that...