CVE-2026-90506 vvbbnn00 WARP-Clash-API Save Account Job race condition

A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. Th...

CVE-2026-90506 vvbbnn00 WARP-Clash-API Save Account Job race condition

A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. Th...

CVE-2026-90561: Improper Neutralization of Input During Web Page Generation

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

PT-2026-90822

Name of the Vulnerable Software and Affected Versions vvbbnn00 WARP-Clash-API versions up to c7bf2360073959861219b422e51ae86411051b46 Description A race condition exists within an unknown function of the Save Account Job component. This issue allows a remote attacker to initiate an attack, althou...

CVE-2026-89080: Improper Authentication

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to...

PT-2026-90832

Name of the Vulnerable Software and Affected Versions Strapi versions 4.x through 4.26.2 Strapi versions prior to 5.48.1 Description A stored cross-site scripting issue exists in the content manager WYSIWYG preview component due to a failure to strip script tags from rich text. A user with the...

CVE-2026-90506: Concurrent Execution using Shared Resource with Improper Synchronization

A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. Th...

PT-2026-90833

CVE-2026-90562 isn't a prompt injection zero-day. it's a password reset bug straight out of the OWASP Top 10 circa 2005, wearing an "agentic AI" badge. LangBot orchestrates LLM agents across Discord, Telegram, Slack bridges. the CVE lets an attacker hit the password reset endpoint and walk straig...

CVE-2026-90562: Insufficient Entropy

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and...

CVE-2026-81402

creationtimestamp| type| source ---|---|--- 2026-09-12 16:40:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvdjhdpavg2t 2026-09-12 20:01:01+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvduoifhap2o...

CVE-2026-90533

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-15451 MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'addsubaccountuser' function that passes the raw 'userdata' array to 'wpinsertuser' without filtering...

CVE-2026-15451

The MemberPress Corporate Accounts plugin for WordPress is affected by a privilege escalation vulnerability through mass assignment in versions up to and including 1.5.39 . The root cause lies in the add_sub_account_user function, which passes the raw userdata array to wp_insert_user without filt...

CVE-2026-15451 MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'addsubaccountuser' function that passes the raw 'userdata' array to 'wpinsertuser' without filtering...

EUVD-2026-76851

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-90533 Flowise before 3.1.4 Broken Access Control via organizationuser

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-90533

Flowise before 3.1.4 is affected by a broken access control vulnerability in the GET /api/v1/organizationuser endpoint. Any authenticated organization member can query the endpoint with an arbitrary user ID to retrieve the organization owner's full user record, including the bcrypt password hash ...

CVE-2026-90533 Flowise before 3.1.4 Broken Access Control via organizationuser

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-90533 Flowise before 3.1.4 Broken Access Control via organizationuser

Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with an...

CVE-2026-90474 MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass

MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens...