CVE-2026-13604

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows...

CVE-2026-18141 Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

CVE-2026-18141

The CVE-2026-18141 entry concerns aap-gateway in Ansible Automation Platform’s Event-Driven Ansible (EDA). Affected component: aap-gateway. Vulnerability: an unauthenticated remote attacker can bypass mutual TLS on event streams by manipulating the event stream URL and forging the HTTP Subject he...

CVE-2026-18141

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

SummaryThe SSE Server-Sent Events server in src/praisonai-agents/praisonaiagents/server/server.py exposes a /publish endpoint that broadcasts arbitrary messages to all connected clients without any authentication. The ServerConfig dataclass line 24 defines an authtoken field, but this token is...

EUVD-2026-41539

Authorization Bypass Through User-Controlled Key CWE-639 in CalendarDeleteEventController app/Http/Controllers/Calendar/CalendarDeleteEventController.php, exposed at GET /calendar/event/delete/id, in Prospero Flow CRM before 5.5.3 allows a remote, authenticated attacker to delete arbitrary calend...

CVE-2026-33128

CVE-2026-33128 (H3) is a vulnerability in the H3 HTTP framework where insufficient newline sanitization in SSE message formatting can be exploited to inject arbitrary SSE events. The issue affects versions prior to 1.15.6 and 2.0.0 through 2.0.1-rc.14, allowing an attacker who controls any part o...

CVE-2026-1983 SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion

The SEATT: Simple Event Attendance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing nonce validation on the event deletion functionality. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2026-24471

continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room rejecting an invite, joining a room or knocking on a room, the...

CVE-2026-24471 Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')

continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room rejecting an invite, joining a room or knocking on a room, the...

CVE-2026-24471

continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room rejecting an invite, joining a room or knocking on a room, the...

PT-2026-5720

Name of the Vulnerable Software and Affected Versions Continuwuity versions prior to 0.5.1 Conduit versions prior to 0.10.11 Grapevine versions prior to 0aae932b Tuwunel versions prior to 1.4.9 Description A flaw exists that allows a malicious remote server to cause a local server to sign an...

WordPress Plugin Community Events Security Vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

WordPress Community Events plugin <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter vulnerability

Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter vulnerability discovered by Itthidej Aramsri Boeing777 in WordPress Plugin Community Events versions = 1.5.6...

CVE-2021-31559

A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders...

Linux Distros Unpatched Vulnerability : CVE-2025-22239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Arbitrary event injection on Salt Master. The master's minionevent method can be used by and authorized minion to send arbitrary events onto the master's event...

GHSA-C46W-GR7F-JM2P Salt vulnerable to arbitrary event injection

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

CVE-2025-22239

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

UBUNTU-CVE-2025-22239

Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...

BIT-MOODLE-2024-1439 Inadequate access control vulnerability in Moodle

Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent...