PT-2026-65775

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stm lms delete cover function lacking ownership validation on the file id parameter befor...

FakeIDet3-DB: Refining Digital Attacks and Patch Extraction for Secure ID Benchmarking

Identity document ID authentication relies on the structural integrity of complex, high-frequency security patterns. However, advanced Generative AI models can now inject localized, high-fidelity manipulations, creating deceptive attacks that bypass standard verification. Training robust image...

PT-2026-65826

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

PT-2026-65817

Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces using a label selector alone, without ingress-class or namespace...

CVE-2026-47726 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...

CVE-2026-66750

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

CVE-2026-64643

A flaw was found in Next.js. Unauthenticated users can exploit this vulnerability by accessing publicly served client artifacts, which may disclose Server Action IDs. This bypasses authentication on pages where these endpoints are used, leading to information disclosure. While primarily an...

AntD Admin - Sensitive Information Disclosure Detection

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

WordPress Guppy <=1.1 - Information Disclosure Detection

WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another. !/usr/bin/env python3 -- coding:...

Interswitch Webpay - Credentials Exposure Detection

Exposure of Interswitch Webpay product IDs, MAC keys and access tokens. !/usr/bin/env python3 -- coding: utf-8 -- """Exposure of Interswitch Webpay product IDs, MAC keys and access tokens.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Jellyfin Public Users - Exposure Detection

The Jellyfin media server exposed user information via the public users API endpoint. This endpoint could have leaked sensitive data including usernames, user IDs, server IDs, administrator status, password configuration, login activity, and user policies without authentication. !/usr/bin/env...

IDP Skills Installer - Exposure Detection

Checks for the presence of an IDS Skills Installer page. !/usr/bin/env python3 -- coding: utf-8 -- """Checks for the presence of an IDS Skills Installer page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IDP Skill...

Adlisting Classified Ads 2.14.0 - Information Disclosure Detection

Information disclosure issue in the redirect responses, When accessing any page on the website, Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects. !/usr/bin/env python3 -- coding: utf-8 -- """Information disclosure issue in the redirect...

Security update for libssh

This update for libssh fixes the following issues: CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. CVE-2026-59844: denial of service via oversized SFTP read length bsc1272165. CVE-2026-59845: denial of service via unchecked ProxyCommand fork failure bsc127216...

CVE-2026-14516

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-14516

The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is affected by a time-based SQL Injection via the staff_ids parameter in all versions up to 27.5. Root cause: insufficient escaping of user input and inadequate preparation of the existing SQL query. Impact: unauthenti...

EUVD-2026-49720

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

PT-2026-65418

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

PT-2026-65520

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

Security update for agama-web-ui (important)

openSUSE security update: security update for agama-web-ui ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21448-1 Rating: important References: bsc1246822 bsc1259169 bsc1268851 bsc1269359 bsc1269514 bsc1269595 bsc1269927 bsc1272310 bsc1272311...