CVE-2026-11399: Authorization Bypass Through User-Controlled Key

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

PT-2026-104505

Name of the Vulnerable Software and Affected Versions Helpdesk Support Ticket System for WooCommerce versions prior to 2.1.7 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or high...

PT-2026-104500

Name of the Vulnerable Software and Affected Versions Photo Reviews for WooCommerce versions prior to 1.2.31 Description An issue allows unauthenticated attackers to permanently delete arbitrary posts, pages, products, or media attachments. The flaw occurs because the plugin stores...

PT-2026-104548

Name of the Vulnerable Software and Affected Versions Nelio Content – Editorial Calendar & Social Media Auto-Posting versions prior to 4.5.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This allows...

PT-2026-104589

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

PT-2026-104531

Name of the Vulnerable Software and Affected Versions Mailchimp for WooCommerce WordPress plugin versions prior to 6.3 Description An issue exists where the plugin fails to require authentication, a nonce a unique token used to prevent replay attacks, or an ownership check before processing actio...

CVE-2026-94505: Missing Authorization

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-104478: Improper Limitation of a Pathname to a Restricted Directory

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

PT-2026-104582

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description An improper authorization issue exists where delegated administrators can destroy sessions outside their assigned realms. This occurs because realm checks are performed using the requester's realm...

RazerEoP

RazerEoP Razer Synapse 3 宏模块中任意文件删除/移动的 PoC。 该模块允许用户将创建的宏导出到磁盘上的文件，文件操作由以 nt authority\system 身份运行的 razer 服务完成。 我尝试通过他们的 BB 计划向 razer 报告此问题，得到的回复是这不是一个 bug，而是一个漏洞 🤣。 随后我将其报告给 HackerOne，但由于报告年代久远，该报告被以 Informative 状态关闭。 受影响版本 为 3.7.1209.121307 及以下。 任意删除...

CVE-2026-104478 Formwork before 2.3.13 Path Traversal via BackupController Download and Delete

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

CVE-2026-104478 Formwork before 2.3.13 Path Traversal via BackupController Download and Delete

Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP...

CVE-2026-104873

The LangGraph Python SDK is vulnerable to an authorization bypass in versions 0.1.45 through 0.4.3 . The root cause is that resource-scoped authorization decorators (@auth.on.threads , @auth.on.assistants , and @auth.on.crons ) ignore the actions argument, registering handlers for every action on...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

CVE-2026-104873 LangGraph SDK custom auth silently ignores actions= on resource decorators

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore the...

zoshrinkC2

MeliziaC2 DNS over HTTPS 定向恶意软件（仅运行一次） ! 部分功能尚不可用！ ! WIP，请勿在生产环境使用！ 主要特性 失败时自动删除恶意软件 完全加密（每个受害者独立的 RSA 密钥）的 DoH（DNS-over-HTTPS）通信 恶意软件仅运行一次！ 示意图 图片 依赖 https://github.com/demon-i386/throatcut 使用步骤 0 - 编辑 contractgenerator.py 文件 modify C2ServerVariable: C2ServerIP = "attacker.domain.com" 为智能合约部署创建一...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

CVE-2026-104453

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the deletetag parameter via top-level navigation, carrying the...

CVE-2026-104443

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

CVE-2026-104447

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...