CVE-2026-9709: Undefined Security Weakness

The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co...

PT-2026-52095

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.5.0 Rocket.Chat versions prior to 8.4.2 Rocket.Chat versions prior to 8.3.4 Rocket.Chat versions prior to 8.2.4 Rocket.Chat versions prior to 8.1.5 Rocket.Chat versions prior to 8.0.6 Rocket.Chat versions prior ...

CVE-2026-10753: Undefined Security Weakness

The Site Kit by Google WordPress plugin before 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users who have been granted dashboard sharing access such as Editors to modify a site-wide Site Kit by Google WordPress plugin before 1.176.0...

CVE-2026-45757: Insufficient Session Expiration

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, Rocket.Chat allows users deactivated through users.deactivateIdle to keep using already-issued login tokens. A user that an administrator has...

CVE-2026-55455: Server-Side Request Forgery (SSRF)

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils used by the REST API and GraphQL datasource plugins validates hosts against an exact-match string denylist. The comprehensive address-class check...

invenio-accounts (>=1.0.0a1, <=1.0.0a5), python-database-rest-logging (>=1.0.2, <=1.0.5) potentially affected by unknown CVE via flask-security (1.7.5)

flask-security PYPI version 1.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask-security and may be impacted: - invenio-accounts =1.0.0a1, =1.0.2, =1.0.5 Source cves: unknown CVE Source advisory: OSV:GHSA-W2J7-F3C6-G8CW...

CVE-2026-50221

In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to...

CVE-2026-13007 Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/ that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are...

CVE-2026-13007 Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/ that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are...

CVE-2026-44170

A flaw was found in MariaDB server. When the CONNECT engine is installed and REST support is enabled on Windows, a user can exploit improper sanitization of the table HTTP attribute. This attribute is interpolated into the curl command line, allowing for arbitrary shell command execution on the...

CVE-2026-56348 n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint

n8n before 2.20.0 contains a credential exfiltration vulnerability in the POST /rest/dynamic-node-parameters/options endpoint that allows authenticated users to bypass Allowed HTTP Request Domains restrictions. Attackers with credential access can cause the n8n server to issue HTTP requests with...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the queryId parameter in the CREST REST API endpoints. An attacker can manipulate LDAP queries by injecting arbitrary LDAP...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the queryId parameter in the CREST REST API endpoints. An attacker can manipulate LDAP queries by injecting arbitrary LDAP...

free (>=0.0.1, <=0.0.2), hdltex (1.0.4) +2 more potentially affected by CVE-2026-12479 via keras (2.0.9)

keras PYPI version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - free =0.0.1, =1.0.0, =1.0.1, =1.0.2 Source cves: CVE-2026-12479 Source advisory: OSV:GHSA-GH82-F9X8-5FRX...

agentiacap (>=0.1.31, <=0.1.37), ap-rest-client (>=0.0.1, <=0.0.5) +7 more potentially affected by CVE-2026-54282 via starlette (0.46.0)

starlette PYPI version 0.46.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - agentiacap =0.1.31, =0.0.1, =1.107.2rc3, =1.0.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.4.7 Source cves: CVE-2026-54282 Source advisory:...

CVE-2026-8157

The Vitepos WordPress plugin (versions before 3.4.2 ) contains a privilege escalation vulnerability. The software fails to properly restrict roles when creating new users through one of its REST API endpoints . This allows authenticated users with a custom Vitepos WordPress plugin role to escalat...

CVE-2026-8157 Vitepos < 3.4.2 - Outlet Manager+ Privilege Escalation

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator...

CVE-2026-8157

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator...

CVE-2026-8157 Vitepos < 3.4.2 - Outlet Manager+ Privilege Escalation

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator...

EUVD-2026-38215

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator...