CVE-2026-13604 Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

CVE-2026-13604

The Pixelavo WordPress plugin (versions before 1.5.4 ) is vulnerable to an unauthenticated Facebook CAPI Event Injection . The flaw exists because the plugin registers an unauthenticated AJAX action gated only by a nonce that is publicly emitted on every front-end page. An unauthenticated visitor...

PT-2026-67034

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

SUSE CVE-2026-4858

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action...

SUSE CVE-2026-42300

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the SessionMiddleware accepts a client-supplied X-Admin-Token HTTP request header and uses its raw string value as the authenticated userID when no Kratos session cookie is present. An unauthenticated...

CVE-2026-67349

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

EUVD-2026-51152

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349

OpenCost before 1.121.0 is vulnerable. The GET /helmValues endpoint does not require authentication, exposing a base64-decoded HELM_VALUES containing cloud provider credentials. Additionally, adminAuthMiddleware is permissive when ADMIN_TOKEN is unset, allowing unauthenticated POST /serviceKey to...

EUVD-2026-49141

A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...

CVE-2026-14856

CVE-2026-14856 : A stored XSS in the Media Manager’s file upload (SVG) of TastyIgniter v4.3.0 arises from insufficient validation/sanitization of SVG files. An authenticated, low-privilege user can upload a malicious SVG; when an administrator views it, JavaScript executes in the admin’s browser....

CVE-2026-14856

A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...

PT-2026-64876

A stored Cross-Site Scripting XSS vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of SVG files. An authenticated user with low privileges can upload a malicious SVG file containing JavaScript code. When...

GO-2026-5675 Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster...

CVE-2026-15015 MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

GO-2026-5102 Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma

Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

CVE-2026-61463

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtai...

CVE-2026-61463

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtai...

PT-2026-57840

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtai...

NPM: OpenClaw: Control UI locality spoofing could mint a durable admin device token

NPM: OpenClaw: Control UI locality spoofing could mint a durable admin device token vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.22...

OpenStack Identity Keystone Exposure of Sensitive Information

The catalog url replacement in OpenStack Identity Keystone before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$admintoken" in the publicurl endpoint field...