EUVD-2026-44638

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream'...

Uncontrolled Resource Consumption

github.com/spectolabs/hoverfly is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the use of http.DefaultClient without a configured timeout for remote post-serve actions, which allows an attacker to trigger requests to a non-responsive endpoint,...

Information Exposure

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Information Exposure due to insufficient group-permission filtering in RealmAdminResource.getRealm,...

CVE-2026-12281

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach...

CVE-2026-11579

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...

EUVD-2026-44592

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...

CVE-2026-11579 Kali Forms < 2.4.17 - Unauthenticated Media Upload

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...

EUVD-2026-44574

In Ciena's Navigator Network Control Suite NCS and Manage Control Plan MCP, there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker...

PT-2026-60193

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.4 Description An authentication bypass occurs when the software is deployed with LIGHTRAG API KEY configured but AUTH ACCOUNTS is not set. This happens because the lightrag/api/auth.py file reverts to a hardcoded...

PT-2026-60360

Name of the Vulnerable Software and Affected Versions dd-trace-py versions prior to 4.8.2 Description Datadog tracing libraries implementing W3C baggage propagation fail to enforce limits on the number of items or total bytes when parsing incoming baggage HTTP headers during the extraction proces...

PT-2026-60371

Name of the Vulnerable Software and Affected Versions FiftyOne versions prior to 1.17.0 Description The FiftyOne App/API server and the /media endpoint unconditionally set a permissive Cross-Origin Resource Sharing CORS header, allowing any website visited by a user to make cross-origin requests ...

PT-2026-60135

PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None, and the server only enforces Authorization/Bearer checks when an API key is configured. When an operator runs 'praisonai mcp serve --transport http-stream'...

Oracle Linux 10 : systemd (ELSA-2026-19068)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19068 advisory. 257-23.0.1.el102.1 - Fix detection of Oracle Virtualization or BM envs Orabug: 37531877 - Avoid udevadm warnings when using udev valid configs Orabug: 3750319...

PT-2026-60277

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultValue entries such as $var and SqlparserUtils.handleVariableDefaultValue inserts them with String.replace without escaping or parameterizatio...

PT-2026-60356

MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci check login function. Any user knowing any valid cookie string can authenticate as any other user knowing their username, including the administrator, without knowing the target's password. The vulnerabili...

dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS

Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing item-count or byte-size limits on the extract path. The DDTRACEBAGGAGEMAXITEMS default 64 and DDTRACEBAGGAGEMAXBYTES default 8192 limits were applied only to baggage injection, n...

Oracle Linux 10 : firefox (ELSA-2026-19041)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-19041 advisory. 140.10.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding...

CVE-2026-5269

In Ciena's Navigator Network Control Suite NCS and Manage Control Plan MCP, there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker...

CVE-2026-5269

Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP) contain hidden system accounts used for internal software operations. These accounts may utilize predictable default passwords . Although these accounts possess limited permissions independently, an attacker could exploit...

CVE-2026-5269 Navigator NCS and MCP System Accounts with Default Passwords

In Ciena's Navigator Network Control Suite NCS and Manage Control Plan MCP, there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker...