CVE-2026-65916

CyberPanel up to version 1.9.1 contains a missing authorization vulnerability in the cancelBackupCreation handler. An authenticated user can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt ba...

PYSEC-2026-3481 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

Summary In affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enabletasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...

CVE-2026-65014 n8n before 2.28.0 Authentication Bypass via test-webhook

n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The...

CVE-2026-65014 n8n before 2.28.0 Authentication Bypass via test-webhook

n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The...

CVE-2026-65014 n8n before 2.28.0 Authentication Bypass via test-webhook

n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The...

EUVD-2026-46409

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-64821

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-64821 djangoSIGE 1.10 CSRF via GET-based Order Cancellation Views

djangoSIGE through 1.10 commit a6fe7e8 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to cancel sales or purchase orders on behalf of authenticated users by exploiting order-cancellation logic implemented inside HTTP GET method handlers in...

CVE-2026-64821

The issue CVE-2026-64821 affects djangoSIGE up to version 1.10. The vulnerability arises in order-cancellation logic (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) implemented in HTTP GET handlers, allowing unauthenticated attackers to...

CVE-2026-47391

PraisonAI’s first-party A2A example exposes an unauthenticated /a2a JSON-RPC surface and registers a calculate(expression) tool implemented via Python eval(), bound to 0.0.0.0. A remote attacker can send message/send to a2a, causing the LLM to invoke the unsafe tool and potentially execute arbitr...

CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...

CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...

SUSE CVE-2026-64069

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream-subrequests list, it can't simply be put and abandoned...

CVE-2026-64206

Summary of CVE-2026-64206 : In the Linux kernel Bluetooth L2CAP subsystem, teardown can deadlock due to a circular lock between l2cap_conn_del() and process_pending_rx(). Specifically, l2cap_conn_del() takes conn->lock and then cancels pending_rx_work, while process_pending_rx() may contend fo...

CVE-2026-64069

A flaw was found in the Linux kernel's netfs component. When a direct I/O DIO or single read subrequest fails during preparation, the subrequest may not be properly cancelled. This can lead to resource leaks or unexpected behavior, potentially impacting system stability...

CVE-2026-11868

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site...

CVE-2026-11868

CVE-2026-11868 concerns the WordPress plugin WP Travel (before version 11.7.1). The issue is that the plugin does not perform capability or ownership checks on its booking cancellation action, which is exposed to unauthenticated users, allowing them to cancel arbitrary bookings on affected sites....

EUVD-2026-45880

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site...

CVE-2026-11868 WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site...

CVE-2026-11868

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site...