CVE-2026-12582 Library Management System < 3.5.8 - Unauthenticated SQL Injection via book_id

The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes...

CVE-2026-11963

The User Registration & Membership WordPress plugin version before 5.2.2 is vulnerable to an Insecure Direct Object Reference (IDOR) . The plugin fails to perform adequate authorization checks during a membership-upgrade action, incorrectly using a caller-supplied identifier to determine the targ...

CVE-2026-12271 Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR

The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail...

MINI-R7FX-8PW6-RVCW

Bulletin has no description...

MINI-PPH2-V5HC-CQX8

Bulletin has no description...

EUVD-2026-43264

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component runproject. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. T...

CVE-2026-15522 tugcantopaloglu godot-mcp run_project index.js validatePath path traversal

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component runproject. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. T...

MINI-2WWP-5W84-68F5

Bulletin has no description...

EUVD-2026-43263

A vulnerability was determined in GNU LibreDWG 0.13.4-154-g0b573035. This impacts the function decompressR2004section of the file src/decode.c of the component R2004 Section Decompression. Executing a manipulation can lead to heap-based buffer overflow. The attack requires local access. The explo...

MINI-HJM7-6X9C-HGWW

Bulletin has no description...

CVE-2026-15512

creationtimestamp| type| source ---|---|--- 2026-07-13 00:29:31+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqigrl4mk42f 2026-07-13 04:23:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqitumodw52l...

MINI-72VP-99F2-95G7

Bulletin has no description...

MINI-8FGG-Q3XP-CV52

Bulletin has no description...

PT-2026-59354

Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite Affected Component Retrieval web/YouTube processing endpoints: - backend/open webui/routers/retrieval.py lines 1810-1837, process web - backend/open webui/routers/retrieval.py the parallel process youtube endpoint ...

PT-2026-59388

Description There's an IDOR in the channels message management system that allows authenticated users to modify or delete any message within channels they have read access to. The vulnerability exists in the message update and delete endpoints, which implement channel-level authorization but...

PT-2026-59393

Cross-User File Access via Unchecked file id in Folder Knowledge and Knowledge-Base Attach Endpoints Summary Multiple endpoints accept a user-supplied file id and attach the referenced file to a resource the caller controls folder knowledge, knowledge-base contents without verifying that the call...

PT-2026-59377

Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts Affected Component Folder creation endpoint and form model: - backend/open webui/models/folders.py lines 72-77, FolderForm with extra='allow' - backend/open webui/models/folders.py lines 95-106, insert new...

PT-2026-59063

A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr main agent of the file astrbot/core/astr main agent.py. Such manipulation of the argument session id leads to authorization bypass. It is possible to launch the attack remotely. The exploit is publicly...

PT-2026-57839

Name of the Vulnerable Software and Affected Versions mcp-gitlab versions prior to 2.1.18 Description A path traversal issue exists in the job id parameter within the build/index.js file. This allows attackers to escape the intended path prefix by providing crafted values, such as ../../../user, ...

CVE-2026-15557: Improper Authentication

A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This...