CVE-2026-103323

The Integration for Epos Now and WooCommerce WordPress plugin (versions 4.6.0-4.11.1 ) is vulnerable to an unauthenticated Action Scheduler Queue Disclosure vulnerability. The root cause is a missing authorization check on one of the plugin's REST endpoints. This allows unauthenticated users to r...

CVE-2025-12721

g-FFL Cockpit 'returntrue', haciéndolo completamente accesible para cualquier visitante no autenticado. Ubicado en class-sync-endpoint.php: 88: registerrestroute'fflcockpit/v1', '/serverstatus', 89: 'methods' = 'GET', 90: 'callback' = CLASS, 'handleserverstatus', 91: 'permissioncallback' =...

CVE-2024-10924

CVE-2024-10924 - Authentication Bypass in Really Simple Security OVERVIEW This project demonstrates the exploitation and mitigation of CVE-2024-10924, a critical authentication bypass vulnerability in the WordPress "Really Simple Security" plugin. STEP 1: ENVIRONMENT SETUP Start the vulnerable...

LiteLLM - Command Injection

A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the /mcp-rest/test/connection endpoint with controlled parameters, resulting in arbitrary command...

CVE-2026-76265: Improper Access Control

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the "admin" or "power" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could...

CVE-2026-76269: Authorization Bypass Through User-Controlled Key

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, jo...

Apache SeaTunnel 3.0.0 Remote Code Execution

Summary SeaTunnel is a very easy-to-use, ultra-high-performance, distributed data integration platform that supports real-time synchronization of massive data. It can synchronize tens of billions of data stably and efficiently every day, and has been used in production by nearly 100 companies...

CVE-2026-76270: Improper Neutralization of Special Elements used in an SQL Command

In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...

CVE-2026-76275: Improper Authorization

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution...

PT-2026-107409

The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind...

PT-2026-107689

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description A user with the read o11y content capability can inject forged entries into the app log via the REST...

PT-2026-107697

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Description An improper authorization issue exists in the REST API,...

CVE-2026-76274: Server-Side Request Forgery (SSRF)

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the reado11ycontent capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer REST API to an attacker-controlled host and...

PT-2026-107700

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Description An authorization bypass exists in the Representational State Transfer REST API. A user with the edit...

PT-2026-107687

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Splunk Secure Gateway versions prior to 3.10.11 Splunk Secure Gateway...

PT-2026-107499

On MISP instances configured to require TOTP enrolment Security.otp required, the enforcement of the mandatory two-factor authentication setup applied only to standard browser requests. An authenticated user who had not yet enrolled in TOTP could bypass the forced setup by issuing any non-browser...

PT-2026-107396

The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when...

PT-2026-107690

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Description An unauthenticated user with network access to the Patroni REST API on a search head cluster member can execute arbitrary operating-system...

PT-2026-107691

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Description An improper access control issue exists in the REST API,...

PT-2026-107694

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.3 Splunk Enterprise versions prior to 10.2.7 Splunk Enterprise versions prior to 10.0.10 Splunk Enterprise versions prior to 9.4.15 Splunk Secure Gateway versions prior to 3.10.11 Splunk Secure Gateway...