GO-2026-6481 Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint in github.com/mattermost/mattermost-server

Mattermost doesn't enforce bot-specific permission checks on the user active status endpoint in github.com/mattermost/mattermost-server...

PT-2026-99786

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A security flaw in the Domain Handler component allows for remote SQL injection. The issue exists within the get domain status function located in the...

PT-2026-102335

Name of the Vulnerable Software and Affected Versions @grpc/grpc-js versions prior to 1.13.6 @grpc/grpc-js versions prior to 1.14.5 Description When an application method handler throws an uncaught error, the server includes the error message in the status message sent to the client. This can lea...

PT-2026-99779

Name of the Vulnerable Software and Affected Versions Verge3D WordPress plugin versions 4.1.0 through 4.13.0 Description An issue exists where the plugin fails to verify payment status with the payment provider and does not validate order ownership. This allows unauthenticated users to mark any...

PT-2026-99860

Name of the Vulnerable Software and Affected Versions Thinkware U3000 versions prior to 1.02.04 Description A security flaw in the TCP Service component allows remote information disclosure. This occurs through the manipulation of the wifi info argument within the GET STATUS function...

PT-2026-102327

Name of the Vulnerable Software and Affected Versions Webkul Bagisto versions prior to 2.4.7 Description An authorization bypass exists in the Invoice Mass Status Update component. A remote attacker can manipulate the endpoint '/admin/sales/invoices/mass-update/state' to perform actions without...

CVE-2026-101139: Missing Authorization

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotel...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: rancher-helm, docker-cli-buildx, k3s, docker, wolfictl, cluster-api-helm-controller, kubevela, zot, kube-arangodb, neuvector-scanner, rancher, manifest-tool, chartmuseum, kubescape, tigera-operator, headlamp, dagger, gatekeeper, xeol, trivy-operator, eksctl, buildkit...

CVE-2026-100606

Flowise through 3.1.4 Enterprise/platform mode with SSO enabled contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin SSOBase.ts:80-94 copies the user record from the database — including the...

CVE-2026-100606 Flowise through 3.1.4 Authentication Bypass via SSO Email Match

Flowise through 3.1.4 Enterprise/platform mode with SSO enabled contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin SSOBase.ts:80-94 copies the user record from the database — including the...

CVE-2026-100606

Flowise versions through 3.1.4 (Enterprise/platform mode with SSO enabled) are vulnerable to an authentication bypass in the SSO login path. The root cause lies in verifyAndLogin (SSOBase.ts:80-94 ), which incorrectly copies the database user record—including the server-stored tempToken—into the ...

CVE-2026-100606 Flowise through 3.1.4 Authentication Bypass via SSO Email Match

Flowise through 3.1.4 Enterprise/platform mode with SSO enabled contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin SSOBase.ts:80-94 copies the user record from the database — including the...

CVE-2026-100557 OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials reserved for owners...

CVE-2026-100546

OpenClaw npm package "openclaw" versions = 2026.7.2 and 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a...

EUVD-2026-87504

OpenClaw npm package openclaw versions = 2026.7.2 and 2026.9.2 contain a race condition in the Discord realtime voice transcript path. Concurrent control-classified voice transcripts could consume speaker context belonging to another participant after an asynchronous control check, causing a...

PT-2026-99183

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.7.2 through 2026.9.1 Description A race condition exists in the Discord realtime voice transcript path. This occurs when concurrent control-classified voice transcripts consume speaker context from another participant...

EUVD-2026-87268

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid "Good" PGP signature from a registered sender key, even though the displayed message content i...

CVE-2026-67409 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CWE-252. the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response...

CVE-2026-97228

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

UBUNTU-CVE-2026-97567

In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent race between disconnect and rtx Sashiko noted that the two event can race, leading to inconsistent status. Prevent the race using the synchronous timer stop operation...