14117 matches found
CVE-2026-10552
The CVE-2026-10552 entry concerns the WordPress plugin Blue Captcha (versions up to 2.0.1). It documents a Cross-Site Request Forgery (CSRF) flaw caused by missing or incorrect nonce validation on the main admin page (blcap_main_page) and on Hall of Shame and Log subpages. These pages accept a bl...
PT-2026-51697
Name of the Vulnerable Software and Affected Versions Generate Security.txt plugin for WordPress versions prior to 1.0.13 Description The plugin fails to properly verify user authorization for specific actions. This allows authenticated attackers with subscriber-level access or higher to delete t...
PT-2026-52168
Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.2.17 Drupal AI versions 1.3.0 through 1.3.8 Drupal AI versions 1.4.0 through 1.4.3 Description A missing authorization issue allows forceful browsing. Certain Drupal core actions exposed as agent tools lack...
AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055
This module enables you to utilize an agent to use Drupal core actions tools with bypassed access. Certain Drupal core actions, exposed as agent tools did not have correct access validation, and some core actions were missing associated access-level definitions. This vulnerability is mitigated by...
Missing Authorization
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization in the API endpoints responsible for category creation, FAQ creation, FAQ updating, and question creation due to missing permissio...
Missing Authorization
Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization in the API endpoints responsible for category creation, FAQ creation, FAQ updating, and question creation due to missing permissio...
[SECURITY] [DLA 4641-1] beets security update
Debian LTS Advisory DLA-4641-1 [email protected] https://www.debian.org/lts/security/ Emmanuel Arias June 23, 2026 https://wiki.debian.org/LTS Package : beets Version : 1.4.9-7+deb11u1 CVE ID : CVE-2026-42052 Debian Bug : 1135779 It was discovered that beets, a media library management...
GHSA-J67X-Q29F-QCVV motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution
Summary The ActionHandler.post method in motionEye has no authentication decorator, allowing any unauthenticated attacker to trigger camera actions including snapshots, recording start/stop, and configured action scripts PTZ controls, alarm triggers, etc.. Vulnerability Details File:...
CVE-2026-54007
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim...
CVE-2026-54306
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to inject attacker-controlled fields into workflow data during internal object copying. These fields could be surfaced and consumed as norma...
CVE-2026-54007 Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt in an authenticated victim...
‘Cordyceps’ CI/CD Flaw Exposes Microsoft, Google, Apache Repos to Pipeline Hijacking
Novee Security reveals Cordyceps, a CI/CD vulnerability in GitHub Actions workflows that let anonymous users poison builds and expose tokens across major projects today...
CVE-2026-12151 vulnerabilities
Vulnerabilities for packages: haraka, pelias-api, kibana, saf, node-gyp, actions-runner, renovate, gemini-cli, vitess, npm, code-server, prism, py3-captum...
GHSA-VXPW-J846-P89Q vulnerabilities
Vulnerabilities for packages: haraka, pelias-api, kibana, saf, node-gyp, actions-runner, renovate, gemini-cli, vitess, npm, code-server, prism, py3-captum...
CVE-2026-11525 vulnerabilities
Vulnerabilities for packages: haraka, pelias-api, kibana, saf, node-gyp, actions-runner, renovate, gemini-cli, vitess, npm, code-server, prism, py3-captum...
CVE-2026-6733 vulnerabilities
Vulnerabilities for packages: haraka, pelias-api, kibana, saf, node-gyp, actions-runner, renovate, gemini-cli, vitess, npm, code-server, prism, py3-captum...
CVE-2026-9679 vulnerabilities
Vulnerabilities for packages: haraka, pelias-api, kibana, saf, node-gyp, actions-runner, renovate, gemini-cli, vitess, npm, code-server, prism, py3-captum...
GHSA-35P6-XMWP-9G52 vulnerabilities
Vulnerabilities for packages: haraka, pelias-api, kibana, saf, node-gyp, actions-runner, renovate, gemini-cli, vitess, npm, code-server, prism, py3-captum...