GHSA-GH98-4PHW-6FMW Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...

tomcat: Apache Tomcat: Denial of Service via WebSocket chat example

A flaw was found in Apache Tomcat. This uncontrolled resource consumption vulnerability, located in the WebSocket chat example, allows a remote attacker to cause a Denial of Service DoS by exhausting system resources. This can lead to the affected system becoming unresponsive or crashing...

tomcat: Apache Tomcat: Denial of Service via WebSocket chat example

A flaw was found in Apache Tomcat. This uncontrolled resource consumption vulnerability, located in the WebSocket chat example, allows a remote attacker to cause a Denial of Service DoS by exhausting system resources. This can lead to the affected system becoming unresponsive or crashing...

PT-2026-107507

Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b11393 Description A use-after-free and double free issue exists in the common chat peg mapper::map function. Unauthenticated remote attackers can corrupt heap memory by utilizing a dangling current tool pointer. Th...

CVE-2026-39730

Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3...

CVE-2026-39730 WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3...

EUVD-2026-93252

Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.2...

CVE-2026-39730 WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3...

CVE-2026-39730

The Wise Chat plugin for WordPress (versions

CVE-2026-39730: Missing Authorization

Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3...

PT-2026-106417

Name of the Vulnerable Software and Affected Versions Wise Chat versions prior to 3.4.3 Description An authorization flaw exists due to incorrectly configured access control security levels, which allows for broken access control for subscribers. Recommendations Update to version 3.4.3 or later...

GHSA-G7FW-3GJP-G5HF OpenClaw: Channel read actions could skip target allowlists

Summary Channel read actions could skip target allowlists. In affected versions, explicit read targets in Microsoft Teams, Feishu, Matrix, and Google Chat could reach channels or rooms outside the configured read policy. This advisory is scoped to caller-supplied targets for message, reaction, pi...

OpenClaw: Channel read actions could skip target allowlists

Summary Channel read actions could skip target allowlists. In affected versions, explicit read targets in Microsoft Teams, Feishu, Matrix, and Google Chat could reach channels or rooms outside the configured read policy. This advisory is scoped to caller-supplied targets for message, reaction, pi...

WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by takito in WordPress Plugin Wise Chat versions = 3.4.3...

PT-2026-106272

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.30.0 Description A partial denial of service issue exists in the OpenAI-compatible chat endpoint. A remote caller can provide large values for the fps and max frames variables within the media io kwargs field while...

CVE-2026-100149

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature attacker-obtained via inlinejs identify payload' parameter. This makes it possible...

CVE-2026-100149 WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature attacker-obtained via inlinejs identify payload' parameter. This makes it possible...

CVE-2026-100149 WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature attacker-obtained via inlinejs identify payload' parameter. This makes it possible...

CVE-2026-100149

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 4.7.3 . An unauthenticated attacker can exploit an HMAC Signature Collision (due to missing domain separation) in the x...

CVE-2026-100149 WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`…

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature attacker-obtained via inlinejs identify payload' parameter. This makes it possible...