CVE-2026-33434

CVE-2026-33434 affects Wazuh 4.6.0+ up to 4.14.5. A logic error in CheckRateLimitsMiddleware.dispatch() causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When global max_request_per_minute is exceeded, /events requests can still succeed if the even...

CVE-2026-33434

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When t...

CVE-2026-33434 Wazuh: Rate Limit Bypass via /events Endpoint

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.6.0 and above, prior to 4.14.5, a logic error in CheckRateLimitsMiddleware.dispatch causes the /events endpoint rate check to unconditionally overwrite the general rate limit result. When t...

GHSA-JPW9-PFVF-9F58 MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...

CVE-2026-29115

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:12+00:00| seen| Telegram/vFDO5SwsZ7hIMyqUKVS5e9UBDOzM5D4lILt5pmQlyCTvgM 2026-07-16 19:00:12+00:00| seen| Telegram/vkQwkXUL30u3pRsZtV-s7rMERa3mU1vbncFib7BaHrS3aA 2026-07-17 00:00:27+00:00| seen|...

CVE-2019-9702

creationtimestamp| type| source ---|---|--- 2026-07-16 19:00:07+00:00| seen| Telegram/RoMJMyaO9qCYkhsSAc77CM1sHfRGAI14pGHUT-hscWYLSyM 2026-07-16 19:00:07+00:00| seen| Telegram/iYHsotoqlE8Z-AEKaQiVsXXSjTyl0MfV01akvHQ1zfYFYEI 2026-07-17 00:00:10+00:00| published-proof-of-concept|...

CVE-2026-26718

creationtimestamp| type| source ---|---|--- 2026-07-16 18:50:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrvoapjwx2w 2026-07-16 19:00:06+00:00| seen| Telegram/rNnuPZSkZWDVpEPnyDrVrJ0tqHAdHjPuF4Jq-SaqH-76iI 2026-07-17 00:00:10+00:00| published-proof-of-concept|...

CVE-2026-50562

creationtimestamp| type| source ---|---|--- 2026-07-15 18:42:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqper37t2l2d 2026-07-15 19:00:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpfr6wosn2i...

CVE-2026-59836

creationtimestamp| type| source ---|---|--- 2026-07-15 14:20:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqow55nlat2n 2026-07-15 15:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqp2lmddyc2v...

CVE-2026-61436

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...

EUVD-2026-44642

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...

CVE-2026-61436 PraisonAI before 4.6.78 Missing Webhook Signature Verification

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...

CVE-2026-61436

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message...

GHSA-9HC2-HJX8-Q6PV

creationtimestamp| type| source ---|---|--- 2026-07-14 22:42:05+00:00| seen| https://gist.github.com/alon710/2e36d4018e71382099203c9d78e54337 2026-07-15 00:00:00+00:00| seen| https://gist.github.com/alon710/2e36d4018e71382099203c9d78e54337...

CVE-2026-45755

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged...

CVE-2026-45754

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST...

CVE-2026-45755

The CVE-2026-45755 issue affects Symfony’s Mailtrap Mailer Bridge (package symfony/mailtrap-mailer). The MailtrapRequestParser::doParse() method accepts the webhook payload using a configured secret but does not verify the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to forg...

CVE-2026-45755 Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged...

CVE-2026-45755

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged...

CVE-2026-15409

creationtimestamp| type| source ---|---|--- 2026-07-14 17:48:47+00:00| seen| https://bsky.app/profile/blackhatnews.tokyo/post/3mqmrct2poa2b 2026-07-14 18:59:52+00:00| seen| https://bsky.app/profile/hapsis.bsky.social/post/3mqmvbuce4c2u 2026-07-14 19:00:30+00:00| exploited|...