CVE-2026-109695 WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1...

Security Bulletin: Due to the use of jackson-databind, IBM Cloud Pak System is affected by Uncontrolled Resource Consumption and Deserialisation of Untrusted Data

Summary Jackson-databind is used internally by IBM Cloud Pak System CVE-2026-83557 and CVE-2026-68497 . These vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the...

exfil-scan

exfil-scan Scan LLM outputs and AI-generated content for data exfiltration signals before they reach users, logs, or downstream systems. 1 Why exfil-scan exists Modern LLM applications routinely process sensitive prompts, internal documents, API responses, and user data. That creates a new securi...

WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by neurotx in WordPress Plugin Gantry 5 Framework versions = 5.6.4...

PYSEC-2026-4278 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

Summary The Pydantic AI development web chat UI Agent.toweb, clai web did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute...

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

SummaryThe Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

PYSEC-2026-4279 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Summary The Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

PYSEC-2026-4288 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

Summary The Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header

SummaryThe Pydantic AI development web chat UI Agent.toweb, clai web does not validate the Host header of incoming requests. A website a developer visits can use DNS rebinding to make requests to a chat UI running on that developer's machine appear same-origin to the browser, causing the served...

PYSEC-2026-4287 Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint

Summary The Pydantic AI development web chat UI Agent.toweb, clai web did not check the content type of requests to its chat endpoint. This allowed a website visited by a developer to submit a request to a chat UI running on that developer's machine, causing the served agent to run and to execute...

PYSEC-2026-4314 wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry

Summary An authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slotentry ID in a POST /api/v2/workoutlog/ request. The slotentry foreign key is not included in the ownership verification performed by...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-96749 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-96749 Source advisory: OSV:PYSEC-2026-4296...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-88029 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-88029 Source advisory: OSV:PYSEC-2026-4294...

agent

Binary Refinery Skill This repository stores a Claude skill for Binary Refinery. It can augment your malware analysis agent with a number of useful tools for data extraction and transformation. !CAUTION Make sure you are using refinery version 0.10.5 or later. The skill relies on changes to the...

cve-2025-55182

CVE-2025-55182 Python Exploit Python 3 script that can be used to demonstrate CVE-2025-55182. It exploits a server-side JavaScript injection vulnerability in Next.js/React applications, allowing remote code execution via malformed multipart form data. ⚠️ For educational and authorized testing...

CVE-2026-41545

A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version:...

CVE-2026-44084

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

CVE-2026-34015

A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...

CVE-2026-39989

A server-side request forgery SSRF vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312...

DEBIAN-CVE-2026-19864

Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An...